20897828
A Formal Definition for Trust in Distributed Systems
Trust is an important concept in distributed computing environments and plays a critical role in ensuring and enhancing system security. Although various trust models have been proposed for distributed or pervasive computing systems, little research has been conducted to describe trust in precise and formal way. In this paper, we present a formal definition to express the meaning of trust in distributed computing systems. With this definition, we rigorously analyze the important properties of trust relation, such as reflexivity and conditional transitivity, and describe the trust relations in Role-Based Access Control. Our definition is comprehensive in that the semantic meaning of the trust definition is feasible to describe trust relations in both traditional distributed systems and dynamic pervasive computing environments. This research provides a solid base for formal trust reasoning and effective trust management implementation in distributed systems and pervasive computing environments.
27151074
Integrated Support for Location Aware Security Services in Enterprise Wireless Networks
In wireless computing environments limiting network access to authorized users is paramount for the overall security of network. In addition to basic authentication framework, network access is also governed by the context in which it is being used. In this work, we address security issues based on one such context: location. Location sensitivity is increasingly becoming an integral aspect of wireless and pervasive applications. As user moves around in an ubiquitous environment, access rights and other security services provided to her need to be evaluated accordingly. For such purposes we need a security mechanism that controls the authentication and other security services based on location, in addition to basic identity information. In this paper, we present an architecture of location aware security services for enterprise wireless networks. Our implementation is integrated into the RADIUS system, an Authentication, Authorization and Accounting (AAA) framework. Performace evaluation shows that our implementation is efficient for location based security services.
7088840
Communication protection in IP-based video surveillance systems
For decades, video surveillance systems have been crucial in protecting critical infrastructures. Currently the systems are adopting the emerging internetworking digital technology, changing from the traditional isolated analog technology. While there are several advantages of IP-based video surveillance systems, the systems are also exposed to additional new security threats. Security is a critical factor to make the IP-based video surveillance systems practical and usable. In this paper, we address the security threats to the data communications in IP-based video surveillance systems. We first analyze the current approaches, mainly naive and selective methods, to secure real-time video data, and identify their limitations to IP-based video surveillance systems. Then we propose a system design of secure internetworking video surveillance systems. Our proposed approach adopts a randomly adjustable encryption method to provide confidentiality to the data. Our implementation and performance study demonstrate that our approach achieves a good balance of cost-efficiency and security.
242170
Active security support for active networks
Active networks aim to provide a software framework that enables network applications to customize the processing of their communication packets. Security is of critical importance to the success of active networking. This paper presents a design and a description of the implementation for securing the node of an active network using active networking principles. The secure node architecture includes an active node operating system security API, an active security guardian, and quality of protection (QoP) provisions. The architecture supports highly customized and situational policies created by users and applications dynamically. It permits active nodes to satisfy the application-specific dynamic security and protection requirements. The secure node architecture can provide a fundamental base for securing the active network infrastructure. We describe the integration of secure node architecture into an active network software system to demonstrate its flexible and innovative features.
11468499
Secure Information Flow in Mobile Bootstrapping Process
The security of bootstrapping is very important for mobile computing. In this paper, we present the bootstrapping process of the Cherubim security system which uses a smartcard to allow a mobile Cherubim client to universally access remote standard services. In order to prevent any leakage of sensitive information, we apply a type system for secure flows to the bootstrapping source codes. The type system guarantees that well-typed programs satisfy a noninterference security property. This means that the program does not ``leak'''' sensitive data. The type system also produces principal types for type-correct programs that characterize how programs can be called securely. The analysis demonstrates that the type system can ensure secure flow enforcement.
34025553
Security as services in active networks
This paper discusses the design and implementation for supporting customized security services in active networks using active networking principles. The customized security services support is based on a secure node architecture that includes an active node operating system security API, an active security guardian, and quality of protection provisions. The support of highly customized security services permits active nodes to satisfy the application-specific dynamic security and protection requirements. It associates quality of protection with network software and application security. Applications can dynamically select the suitable security configurations and services at each active routing node, based on their security and performance requirements. The secure node architecture, together with the support of dynamically customized security services, can provide a fundamental base for securing the active network infrastructure and active applications.
1313086
Image-based surface detail transfer
Changing an object's appearance by adding geometric details is desirable in many real-world applications. Bump mapping has acted as an alternative to adding geometrical details, to an otherwise smooth object. But constructing visually interesting bump maps requires practice and artistic skills. Computer vision techniques have helped for modeling real-world objects and their surface details. In our approach, for cases where we only want to transfer geometrical details from one object to another, we might not need to explicitly compute 3D structures. In particular, our novel technique captures the geometrical details of an object from a single image in a way that is independent of the object's reflectance property. We can then transfer geometrical details to another surface, producing the appearance of a new surface with added geometrical details while preserving the object's reflectance property. Our method's advantages are that it's simple to implement, requires only a single image for each object, and produces effective results.
3758350
An Analytical Approach to the Performance Evaluation of Master-Slave Computational Models
Abstract Many stochastic models and analysis techniques have been proposed in the literature during the last two decades for the performance evaluation of parallel and distributed systems. However, few of them are directly applicable to practical systems which are generally too complex. In this paper, we analyze performances of the master–slave computational model, one of the most commonly used models in parallel and distributed computations. We propose a hybrid analytical approach by using techniques from the theories of both stochastic task graphs and queueing networks. We apply this method to the analysis of a computational chemistry application running on a Transputer based system. The proposed method turns out to be not only very efficient in time for large systems but also very accurate compared to measuring.
6592348
Scheduling UET-UCT Series-Parallel Graphs on Two Processors
Abstract The scheduling of task graphs on two identical processors is considered. It is assumed that tasks have unit-execution-time, and arcs are associated with unit-communication-time delays. The problem is to assign the tasks to the two processors and schedule their execution in order to minimize the makespan. A quadratic algorithm is proposed to compute an optimal schedule for a class of series-parallel graphs, called SP1 graphs, which includes in particular in-forests and out-forests.
3730862
Distributed Resource Allocation in Stream Processing Systems
Distributed stream processing architecture has emerged as appealing solution to coping with the analysis of large amount of data from dispersed sources. A fundamental problem in such stream processing systems is how to best utilize the available resources so that the overall system performance is optimized. We consider a distributed stream processing system that consists of a network of cooperating servers, collectively providing processing services for multiple data streams. Each stream is required to complete a series of operations on various servers. We assume all servers have finite computing resources and all communication links have finite available bandwidth. The problem is to find distributed schemes to allocate the limited computing resources as well as the communication bandwidth in the system so as to achieve a maximum concurrent throughput for all output streams. We present a generalized multicommodity flow model for the above problem. We develop a distributed resource allocation algorithm that guarantees the optimality. We also provide detailed analysis on the complexity of the algorithm and demonstrate the performance using numerical experiments.
5800626
Hybrid Cache Architecture for High Speed Packet Processing
The exposed memory hierarchies employed in many network processors (NPs) are expensive and hard to be effectively utilized. On the other hand, conventional cache cannot be directly incorporated into NP either because of its low efficiency in locality exploitation for network applications. In this paper, a novel memory hierarchy component, called split control cache, is presented. The proposed scheme employs two independent low latency memory stores to temporarily hold the flow-based and application-relevant information, exploiting the different locality behaviors exhibited by these two types of data. Data movement is manipulated by specially designed hardware to relieve the programmers from details of memory management. Performance evaluation shows that this component can achieve a hit rate of over 90% with only 16 KB of memories in route lookup under link rate of OC-3c and provide enough flexibility for the implementation of most network applications.