7935388
Exploiting task-level concurrency in a programmable network interface
Programmable network interfaces provide the potential to extend the functionality of network services but lead to instruction processing overheads when compared to application-specific network interfaces. This paper aims to offset those performance disadvantages by exploiting task-level concurrency in the workload to parallelize the network interface firmware for a programmable controller with two processors. By carefully partitioning the handler procedures that process various events related to the progress of a packet, the system can minimize sharing, achieve load balance, and efficiently utilize on-chip storage. Compared to the uniprocessor firmware released by the manufacturer, the parallelized network interface firmware increases throughput by 65% for bidirectional UDP traffic of maximum-sized packets, 157% for bidirectional UDP traffic of minimum-sized packets, and 32--107% for real network services. This parallelization results in performance within 10--20% of a modern ASIC-based network interface for real network services.
8220782
Isolating the performance impacts of network interface cards through microbenchmarks
Many factors can prevent a Gigabit Ethernet network interface card (NIC) from achieving line rate in a modern web server. In fact, the various commercially available NICs have different performance characteristics that lead to throughput differences for actual web servers. For example, Figure 1 shows the performance achieved by the thttpd web server for client traces extracted from the Rice University computer science department (CS), a NASA web site (NASA), and the 1998 soccer World Cup tournament (World Cup). The latter two traces are available from the Internet Traffic Archive (http://ita.ee.lbl.gov/). The server system tested includes an AMD Athlon 2600+ XP processor running the FreeBSD 4.7 operating system, 2 GB of DDR SDRAM, a 64-bit/66 MHz PCI bus, and a single 40 GB IDE disk (none of the workloads are disk intensive). The tested systems differ only in their NIC, with the Intel Pro-1000/MT Server and Desktop, Alteon AceNIC with parallelized firmware [2], Netgear GA622T, 3Com 3C996B, and Alteon AceNIC with released firmware arranged from left to right. There are substantial performance differences across the NICs in the web environment, as the fastest NIC consistently achieves 40–60% more throughput than the slowest. A web server interacts with the network in two primary ways: receiving client HTTP requests and sending HTTP responses. Requests are typically quite small, on the order of 200 bytes of ASCII text, while responses vary from empty files to several hundred megabytes. Since web clients and servers communicate using TCP, the server must acknowledge requests, leading to minimum-sized (64-byte) Ethernet frames. Response data must be segmented and encapsulated in Ethernet frames, which allow up to 1460 bytes of TCP content in a maximum-sized (1518-byte) frame. Then, those segments are sent out according to TCP flow control policies based on the receipt of acknowledgments. A high-performance server NIC must thus support data volumes dominated by sends of large
2255453
TCP offload through connection handoff
This paper presents a connection handoff interface between the operating system and the network interface. Using this interface, the operating system can offload a subset of TCP connections in the system to the network interface, while the remaining connections are processed on the host CPU. Offloading can reduce computation and memory bandwidth requirements for packet processing on the host CPU. However, full TCP offloading may degrade system performance because finite processing and memory resources on the network interface limit the amount of packet processing and the number of connections. Using handoff, the operating system controls the number of offloaded connections in order to fully utilize the network interface without overloading it. Handoff is transparent to the application, and the operating system may choose to offload connections to the network interface or reclaim them from the interface at any time. A prototype system based on the modified FreeBSD operating system shows that handoff reduces the number of instructions and cache misses on the host CPU. As a result, the number of CPU cycles spent processing each packet decreases by 16--84%. Simulation results show handoff can improve web server throughput (SEPCweb99) by 15%, despite short-lived connections.
14176330
System Specification Based Network Modeling for Survivability Testing Simulation
As the structure and behavior of computer network becomes complicated and unpredictable, it becomes difficult to test the survivability of network. The modeling and simulation is a widely used approach to predict the behavior of system or set of system. In this research, we apply a modeling methodology to construct the valid model of computer network focusing on its vulnerability for survivability testing. To accomplish our aim, the appropriate modeling method should be defined. Especially, we take advantage of the system specification based modeling approach to construct valid network model.
46189778
Knowledge-Based Modeling and Simulation of Network Access Control Mechanisms Representing Security Policies
It is quite necessary that an organization's information network should be equipped with a proper security system based on its scale and importance. One of the effective methods is to use the simulation model for deciding which security policy and mechanism is appropriate for the complex network. Our goal is to build a foundation of knowledge-based modeling and simulation environment for the network security. Within this environment, users can construct the simulation model of security mechanisms, apply various security policies, and quantitatively analyze their security performance against possible attacks. In this study, we considered security domain and implemented the models based on a systematic modeling approach. We enabled the model to include knowledge in modular fashion and provided well-defined guidelines for transforming security policy to concrete rule set.
15684093
Efficient Authentication and Authorization of Mobile Users Based on Peer-to-Peer Network Mechanisms
This paper presents a peer-to-peer based authentication and authorization infrastructure to minimize authentication delays when mobile users roam across different wireless networks. The basic idea is to avoid exchanging security information between networks visited by a roaming user and the user's home authentication, authorization, and accounting (AAA) server that is typically located in the home network possibly far away from the visited network. Instead, authentication and authorization of a roaming user shall be supported by an AAA server in the visited network. We propose that the AAA server that is responsible for authentication and authorization in a newly visited network locates the AAA server in the previously visited network and retrieves the required security information from that AAA server. The AAA servers can be organized in a peer-to-peer manner and peer-to-peer mechanisms can be applied for searching and transferring security information between them. We propose several mechanisms for quickly locating the previously responsible AAA server in order to decrease authentication delays. The performance of these mechanisms is evaluated by simulations. Real performance measurements show the rather low performance overhead of application level forwarding used in peer-to-peer networks.
15509328
New features for affine-invariant shape classification
An object seen from different viewpoints results in differently deformed images. Affine-invariant shape classification must classify correctly the object, regardless its viewpoint. In this paper, we propose new local and global features invariant under affine transformation. These features can be used for supervised or unsupervised shape classification, and for shape-based image indexing and retrieval. One of the proposed features is related to the convex deficiency and the others are extracted from the area matrix. Area matrix was used by Shen for the similarity matching in image retrieval. However, differently from the Shen's work, we parameterize the shape contour using the affine-length parameter. This makes our features robust to affine parameterization, while Shen's work does not have this property. Experimental results indicate that our method can classify correctly even highly deformed and noisy shapes using small training sets.
8017153
Predicting how ontologies for the semantic web will evolve
The first phase in the evolution of the semantic Web may be the development of decentralized, adaptive ontologies for software specification.