arXiv subjects

Carlos Segarra

Publications and source records attributed to Carlos Segarra.

12 recordsLinked to original sources

arXiv2026

Nanvix: A Multikernel OS Design for High-Density Serverless Deployments

Serverless providers strive for high resource utilization by optimizing deployment density: how many applications can be deployed per host server. However, achieving high deployment density without compromising application performance or isolation remains an open challenge. High density can be achieved by sharing components across applications, yet applications from different tenants must be strongly isolated from each other due to the risk of side-channel attacks. Sharing components across applications from the same tenant, if done naively, can introduce contention on host resources thus negatively affecting application performance. We describe Nanvix, a new multikernel OS that disaggregates ephemeral execution state, unique per application invocation, from long-lived persistent state, shared among invocations from the same tenant. Applications in Nanvix execute inside a lightweight user VM running a micro-kernel that implements threads and memory, and forwards all I/O requests to a system VM. The system VM runs a macro-kernel with a rich set of device drivers and is shared among all invocations from the same tenant. Nanvix' split design achieves strong hypervisor isolation across tenants without sacrificing application performance, and reduces same-tenant contention by multiplexing all I/O requests to the system VM. Thanks to a system-wide co-design, Nanvix achieves order-of-magnitude lower application start up times with moderate I/O overheads. When replaying a production trace, Nanvix needs 20-100x fewer host servers compared to state-of-the-art systems, improving deployment density

cs.OS↗

arXiv2023

Faabric: Fine-Grained Distribution of Scientific Workloads in the Cloud

With their high parallelism and resource needs, many scientific applications benefit from cloud deployments. Today, scientific applications are executed on dedicated pools of VMs, resulting in resource fragmentation: users pay for underutilised resources, and providers cannot reallocate unused resources between applications. While serverless cloud computing could address these issues, its programming model is incompatible with the use of shared memory and message passing in scientific applications: serverless functions do not share memory directly on the same VM or support message passing semantics when scheduling functions dynamically. We describe Faabric, a new serverless cloud runtime that transparently distributes applications with shared memory and message passing across VMs. Faabric achieves this by scheduling computation in a fine-grained (thread/process) fashion through a new execution abstraction called Granules. To support shared memory, Granules are isolated using WebAssembly but share memory directly; to support message passing, Granules offer asynchronous point-to-point communication. Faabric schedules Granules to meet an application's parallelism needs. It also synchronises changes to Granule's shared memory, and migrates Granules to improve locality.

cs.DC↗

arXiv2021

A Novel Framework for the Analysis of Unknown Transactions in Bitcoin: Theory, Model, and Experimental Results

Bitcoin (BTC) is probably the most transparent payment network in the world, thanks to the full history of transactions available to the public. Though, Bitcoin is not a fully anonymous environment, rather a pseudonymous one, accounting for a number of attempts to beat its pseudonimity using clustering techniques. There is, however, a recurring assumption in all the cited deanonymization techniques: that each transaction output has an address attached to it. That assumption is false. An evidence is that, as of block height 591,872, there are several millions transactions with at least one output for which the Bitcoin Core client cannot infer an address. In this paper, we present a novel approach based on sound graph theory for identifying transaction inputs and outputs. Our solution implements two simple yet innovative features: it does not rely on BTC addresses and explores all the transactions stored in the blockchain. All the other existing solutions fail with respect to one or both of the cited features. In detail, we first introduce the concept of Unknown Transaction and provide a new framework to parse the Bitcoin blockchain by taking them into account. Then, we introduce a theoretical model to detect, study, and classify -- for the first time in the literature -- unknown transaction patterns in the user network. Further, in an extensive experimental campaign, we apply our model to the Bitcoin network to uncover hidden transaction patterns within the Bitcoin user network. Results are striking: we discovered more than 30,000 unknown transaction DAGs, with a few of them exhibiting a complex yet ordered topology and potentially connected to automated payment services. To the best of our knowledge, the proposed framework is the only one that enables a complete study of the unknown transaction patterns, hence enabling further research in the fields -- for which we provide some directions.

cs.CR↗

arXiv2020

MQT-TZ: Hardening IoT Brokers Using ARM TrustZone

The publish-subscribe paradigm is an efficient communication scheme with strong decoupling between the nodes, that is especially fit for large-scale deployments. It adapts natively to very dynamic settings and it is used in a diversity of real-world scenarios, including finance, smart cities, medical environments, or IoT sensors. Several of the mentioned application scenarios require increasingly stringent security guarantees due to the sensitive nature of the exchanged messages as well as the privacy demands of the clients/stakeholders/receivers. MQTT is a lightweight topic-based publish-subscribe protocol popular in edge and IoT settings, a de-facto standard widely adopted nowadays by the industry and researchers. However, MQTT brokers must process data in clear, hence exposing a large attack surface. This paper presents MQT-TZ, a secure MQTT broker leveraging Arm TrustZone, a trusted execution environment (TEE) commonly found even on inexpensive devices largely available on the market (such as Raspberry Pi units). We define a mutual TLS-based handshake and a two-layer encryption for end-to-end security using the TEE as a trusted proxy. The experimental evaluation of our fully implemented prototype with micro-, macro-benchmarks, as well as with real-world industrial workloads from a MedTech use-case, highlights several trade-offs using TrustZone TEE. We report several lessons learned while building and evaluating our system. We release MQT-TZ as open-source.

cs.CR↗

arXiv2020

MQT-TZ: Secure MQTT Broker for Biomedical Signal Processing on the Edge

Physical health records belong to healthcare providers, but the information contained within belongs to each patient. In an increasing manner, more health-related data is being acquired by wearables and other IoT devices following the ever-increasing trend of the "Quantified Self". Even though data protection regulations (e.g., GDPR) encourage the usage of privacy-preserving processing techniques, most of the current IoT infrastructure was not originally conceived for such purposes. One of the most used communication protocols, MQTT, is a lightweight publish-subscribe protocol commonly used in the Edge and IoT applications. In MQTT, the broker must process data on clear text, hence exposing a large attack surface for a malicious agent to steal/tamper with this health-related data. In this paper, we introduce MQT-TZ, a secure MQTT broker leveraging Arm TrustZone, a popular Trusted Execution Environment (TEE). We define a mutual TLS-based handshake and a two-layer encryption for end-to-end security using the TEE as a trusted proxy. We provide quantitative evaluation of our open-source PoC on streaming ECGs in real time and highlight the trade-offs.

cs.CR↗

arXiv2020

Kollaps: Decentralized and Dynamic Topology Emulation

The performance and behavior of large-scale distributed applications is highly influenced by network properties such as latency, bandwidth, packet loss, and jitter. For instance, an engineer might need to answer questions such as: What is the impact of an increase in network latency in application response time? How does moving a cluster between geographical regions affect application throughput? How network dynamics affects application stability? Answering these questions in a systematic and reproducible way is very hard, given the variability and lack of control over the underlying network. Unfortunately, state-of-the-art network emulation or testbeds scale poorly (i.e., MiniNet), focus exclusively on the control-plane (i.e., CrystalNet) or ignore network dynamics (i.e., EmuLab). Kollaps is a fully distributed network emulator that address these limitations. Kollaps hinges on two key observations. First, from an application's perspective, what matters are the emergent end-to-end properties (e.g., latency, bandwidth, packet loss, and jitter) rather than the internal state of the routers and switches leading to those properties. This premise allows us to build a simpler, dynamically adaptable, emulation model that circumvent maintaining the full network state. Second, this simplified model is maintainable in a fully decentralized way, allowing the emulation to scale with the number of machines for the application. Kollaps is fully decentralized, agnostic of the application language and transport protocol, scales to thousands of processes and is accurate when compared against a bare-metal deployment or state-of-the-art approaches that emulate the full state of the network. We showcase how Kollaps can accurately reproduce results from the literature and predict the behaviour of a complex unmodified distributed key-value store (i.e., Cassandra) under different deployments.

cs.DC↗

arXiv2019

Secure Stream Processing for Medical Data

Medical data belongs to whom it produces it. In an increasing manner, this data is usually processed in unauthorized third-party clouds that should never have the opportunity to access it. Moreover, recent data protection regulations (e.g., GDPR) pave the way towards the development of privacy-preserving processing techniques. In this paper, we present a proof of concept of a streaming IoT architecture that securely processes cardiac data in the cloud combining trusted hardware and Spark. The additional security guarantees come with no changes to the application's code in the server. We tested the system with a database containing ECGs from wearable devices comprised of 8 healthy males performing a standarized range of in-lab physisical activities (e.g., run, walk, bike). We show that, when compared with standard Spark Streaming, the addition of privacy comes at the cost of doubling the execution time.

cs.CR↗

arXiv2019

Using Trusted Execution Environments for Secure Stream Processing of Medical Data

Processing sensitive data, such as those produced by body sensors, on third-party untrusted clouds is particularly challenging without compromising the privacy of the users generating it. Typically, these sensors generate large quantities of continuous data in a streaming fashion. Such vast amount of data must be processed efficiently and securely, even under strong adversarial models. The recent introduction in the mass-market of consumer-grade processors with Trusted Execution Environments (TEEs), such as Intel SGX, paves the way to implement solutions that overcome less flexible approaches, such as those atop homomorphic encryption. We present a secure streaming processing system built on top of Intel SGX to showcase the viability of this approach with a system specifically fitted for medical data. We design and fully implement a prototype system that we evaluate with several realistic datasets. Our experimental results show that the proposed system achieves modest overhead compared to vanilla Spark while offering additional protection guarantees under powerful attackers and threat models.

cs.CR↗

arXiv2017

Magnetic field dependence of edge states in MoS$_2$ quantum dots

We study the electronic structure of monolayer MoS$_2$ quantum dots subject to a perpendicular magnetic field. The coupling between conduction and valence band gives rise to mid-gap topological states which localize near the dot edge. These edge states are analogous to those of 1D quantum rings. We show they present a large, Zeeman-like, linear splitting with the magnetic field, anticross with the delocalized Fock-Darwin-like states of the dot, give rise to Aharonov-Bohm-like oscillations of the conduction (valence) band low-lying states in the K (K') valley, and modify the strong field Landau levels limit form of the energy spectrum.

cond-mat.mes-hall↗

arXiv2015

Theory of electrons, holes and excitons in GaAs polytype quantum dots

Single and multi-band (Burt-Foreman) k.p Hamiltonians for GaAs crystal phase quantum dots are developed and used to assess ongoing experimental activity on the role of such factors as quantum confinement, spontaneous polarization, valence band mixing and exciton Coulomb interaction. Spontaneous polarization is found to be a dominating term. Together with the control of dot thickness [Vainorious Nano Lett. 15, 2652 (2015)] it enables wide exciton wavelength and lifetime tunability. Several new phenomena are predicted for small diameter dots [Loitsch et al. Adv. Mater. 27, 2195 (2015)], including non-heavy hole ground state, strong hole spin admixture and a type-II to type-I exciton transition, which can be used to improve the absorption strength and reduce the radiative lifetime of GaAs polytypes.

cond-mat.mes-hall↗

arXiv2015

Aharonov-Bohm oscillations and electron gas transitions in hexagonal core-shell nanowires with an axial magnetic field

We use spin-density-functional theory within an envelope function approach to calculate electronic states in a GaAs/InAs core-shell nanowire pierced by an axial magnetic field. Our fully 3D quantum modeling includes explicitly the description of the realistic cross-section and composition of the sample, and the electrostatic field induced by external gates in two different device geometries, gate-all-around and back-gate. At low magnetic fields, we investigate Aharonov-Bohm oscillations and signatures therein of the discrete symmetry of the electronic system, and we critically analyze recent magnetoconductance observations. At high magnetic fields we find that several charge and spin transitions occur. We discuss the origin of these transitions in terms of different localization and Coulomb regimes and predict their signatures in magnetoconductance experiments.

cond-mat.mes-hall↗

arXiv2013

Spin-orbit induced hole spin relaxation in InAs and GaAs quantum dots

We study the effect of valence band spin-orbit interactions on the acoustic phonon assisted spin relaxation of holes confined in quantum dots. Heavy hole-light hole (hh-lh) mixing and all the spin-orbit terms arising from zinc-blende bulk inversion asymmetry (BIA) are considered on equal footing in a fully 3D Hamiltonian. We show that hh-lh mixing and BIA have comparable contributions to the hole spin relaxation in self-assembled QDs, but BIA becomes dominant in gated QDs. The dependence of the hole spin relaxation on the QD geometry and spin splitting energy is drastically different from that of electrons, with a non-monotonic behavior which results from the interplay between SOI terms. Our results reconcile contradictory predictions of previous theoretical works and are consistent with experiments.

cond-mat.mes-hall↗