SEARCH · Searcharxiv

Results for “cs.OS”

Search indexed arXiv papers on artificial intelligence, large language models, computer vision and robotics. Read source abstracts and follow links to arXiv.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 271 records · Page 15Linked to original sources

arXiv2017

Tails & Tor and other tools for Safeguarding Online Activities

There are not many known ways to break Tor anonymity, and they require an enormous amount of computational power. Controlling both entrance and exit nodes allows an attacker to compromise client IP with enough pattern analysis. If an .onion or public website does not use SSL, information will not be encrypted once it reaches the exit node. Tor has been successfully broken by Carnegie Mellon, however they will not answer questions nor confirm their method. This research paper investigates Tails & Tor and other tools for Safeguarding Online Activities.

cs.CR↗

arXiv2017

Exploiting Commutativity For Practical Fast Replication

Traditional approaches to replication require client requests to be ordered before making them durable by copying them to replicas. As a result, clients must wait for two round-trip times (RTTs) before updates complete. In this paper, we show that this entanglement of ordering and durability is unnecessary for strong consistency. Consistent Unordered Replication Protocol (CURP) allows clients to replicate requests that have not yet been ordered, as long as they are commutative. This strategy allows most operations to complete in 1 RTT (the same as an unreplicated system). We implemented CURP in the Redis and RAMCloud storage systems. In RAMCloud, CURP improved write latency by ~2x (13.8 us -> 7.3 us) and write throughput by 4x. Compared to unreplicated RAMCloud, CURP's latency overhead for 3-way replication is just 0.4 us (6.9 us vs 7.3 us). CURP transformed a non-durable Redis cache into a consistent and durable storage system with only a small performance overhead.

cs.DC↗

arXiv2017

Barrier Enabled IO Stack for Flash Storage

This work is dedicated to eliminating the overhead of guaranteeing the storage order in modern IO stack. The existing block device adopts prohibitively expensive resort in ensuring the storage order among write requests: interleaving successive write requests with transfer and flush. Exploiting the cache barrier command for the Flash storage, we overhaul the IO scheduler, the dispatch module and the filesystem so that these layers are orchestrated to preserve the ordering condition imposed by the application can be delivered to the storage. Key ingredients of Barrier Enabled IO stack are Epoch based IO scheduling, Order Preserving Dispatch, and Dual Mode Journaling. Barrier enabled IO stack successfully eliminates the root cause of excessive overhead in enforcing the storage order. Dual Mode Journaling in BarrierFS dedicates the separate threads to effectively decouple the control plane and data plane of the journal commit. We implement Barrier Enabled IO Stack in server as well as in mobile platform. SQLite performance increases by 270% and 75%, in server and in smartphone, respectively. Relaxing the durability of a transaction, SQLite performance and MySQL performance increases as much as by 73X and by 43X, respectively, in server storage.

cs.OS↗

arXiv2017

AppSwitch: Resolving the Application Identity Crisis

Networked applications traditionally derive their identity from the identity of the host on which they run. The default application identity acquired from the host results in subtle and substantial problems related to application deployment, discovery and access, especially for modern distributed applications. A number of mechanisms and workarounds, often quite elaborate, are used to address those problems but they only address them indirectly and incompletely. This paper presents AppSwitch, a novel transport layer network element that decouples applications from underlying network at the system call layer and enables them to be identified independently of the network. Without requiring changes to existing applications or infrastructure, it removes the cost and complexity associated with operating distributed applications while offering a number of benefits including an efficient implementation of common network functions such as application firewall and load balancer. Experiments with our implementation show that AppSwitch model also effectively removes the performance penalty associated with unnecessary data path processing that is typical in those application environments.

cs.NI↗

arXiv2017

A Design-Space Exploration for Allocating Security Tasks in Multicore Real-Time Systems

The increased capabilities of modern real-time systems (RTS) expose them to various security threats. Recently, frameworks that integrate security tasks without perturbing the real-time tasks have been proposed, but they only target single core systems. However, modern RTS are migrating towards multicore platforms. This makes the problem of integrating security mechanisms more complex, as designers now have multiple choices for where to allocate the security tasks. In this paper we propose HYDRA, a design space exploration algorithm that finds an allocation of security tasks for multicore RTS using the concept of opportunistic execution. HYDRA allows security tasks to operate with existing real-time tasks without perturbing system parameters or normal execution patterns, while still meeting the desired monitoring frequency for intrusion detection. Our evaluation uses a representative real-time control system (along with synthetic task sets for a broader exploration) to illustrate the efficacy of HYDRA.

cs.CR↗

arXiv2017

Software Distribution Transparency and Auditability

A large user base relies on software updates provided through package managers. This provides a unique lever for improving the security of the software update process. We propose a transparency system for software updates and implement it for a widely deployed Linux package manager, namely APT. Our system is capable of detecting targeted backdoors without producing overhead for maintainers. In addition, in our system, the availability of source code is ensured, the binding between source and binary code is verified using reproducible builds, and the maintainer responsible for distributing a specific package can be identified. We describe a novel "hidden version" attack against current software transparency systems and propose as well as integrate a suitable defense. To address equivocation attacks by the transparency log server, we introduce tree root cross logging, where the log's Merkle tree root is submitted into a separately operated log server. This significantly relaxes the inter-operator cooperation requirements compared to other systems. Our implementation is evaluated by replaying over 3000 updates of the Debian operating system over the course of two years, demonstrating its viability and identifying numerous irregularities.

cs.CR↗

arXiv2017

Implementation of an Android Framework for USB storage access without root rights

This bachelor thesis describes the implementation of an Android framework to access mass storage devices over the USB interface of a smartphone. First the basics of USB (i.e. interfaces, endpoints and USB On the go) and accessing USB devices via the official Android API are discussed. Next the USB mass storage class is explained, which was de- signed by the USB-IF to access mobile mass storage like USB pen drives or external HDDs. For communication with mass storage devices, most important are the bulk-only transfer and the SCSI transparent command set. Furthermore file systems, for accessing directo- ries and files, are described. This thesis focuses on the FAT32 file system from Microsoft, because it is the most commonly used file system on such devices. After the theory part it is time to look at the implementation of the framework. In this section, the first concern is the purpose in general. Then the architecture of the framework and the actual implementation are presented. Important parts are discussed in detail. The thesis finishes with an overview of the test results on various Android devices, a short conclusion and an outlook to future developments. Moreover the current status of the developed framework is visualized.

cs.OS↗

arXiv2017

Seamless Resources Sharing in Wearable Networks by Application Function Virtualization

The prevalence of smart wearable devices is increasing exponentially and we are witnessing a wide variety of fascinating new services that leverage the capabilities of these wearables. Wearables are truly changing the way mobile computing is deployed and mobile applications are being developed. It is possible to leverage the capabilities such as connectivity, processing, and sensing of wearable devices in an adaptive manner for efficient resource usage and information accuracy within the personal area network. We show that application developers are not yet taking advantage of these cross-device capabilities, however, instead using wearables as passive sensors or simple end displays to provide notifications to the user. We thus design AFV (Application Function Virtualization), an architecture enabling automated dynamic function virtualization and scheduling across devices in a personal area network, simplifying the development of the apps that are adaptive to context changes. AFV provides a simple set of APIs hiding complex architectural tasks from app developers whilst continuously monitoring the user, device and network context, to enable the adaptive invocation of functions across devices. We show the feasibility of our design by implementing AFV on Android, and the benefits for the user in terms of resource efficiency, especially in saving energy consumption, and quality of experience with multiple use cases.

cs.OS↗

arXiv2017

EmLog: Tamper-Resistant System Logging for Constrained Devices with TEEs

Remote mobile and embedded devices are used to deliver increasingly impactful services, such as medical rehabilitation and assistive technologies. Secure system logging is beneficial in these scenarios to aid audit and forensic investigations particularly if devices bring harm to end-users. Logs should be tamper-resistant in storage, during execution, and when retrieved by a trusted remote verifier. In recent years, Trusted Execution Environments (TEEs) have emerged as the go-to root of trust on constrained devices for isolated execution of sensitive applications. Existing TEE-based logging systems, however, focus largely on protecting server-side logs and offer little protection to constrained source devices. In this paper, we introduce EmLog -- a tamper-resistant logging system for constrained devices using the GlobalPlatform TEE. EmLog provides protection against complex software adversaries and offers several additional security properties over past schemes. The system is evaluated across three log datasets using an off-the-shelf ARM development board running an open-source, GlobalPlatform-compliant TEE. On average, EmLog runs with low run-time memory overhead (1MB heap and stack), 430--625 logs/second throughput, and five-times persistent storage overhead versus unprotected logs.

cs.CR↗

arXiv2017

Reservation-Based Federated Scheduling for Parallel Real-Time Tasks

This paper considers the scheduling of parallel real-time tasks with arbitrary-deadlines. Each job of a parallel task is described as a directed acyclic graph (DAG). In contrast to prior work in this area, where decomposition-based scheduling algorithms are proposed based on the DAG-structure and inter-task interference is analyzed as self-suspending behavior, this paper generalizes the federated scheduling approach. We propose a reservation-based algorithm, called reservation-based federated scheduling, that dominates federated scheduling. We provide general constraints for the design of such systems and prove that reservation-based federated scheduling has a constant speedup factor with respect to any optimal DAG task scheduler. Furthermore, the presented algorithm can be used in conjunction with any scheduler and scheduling analysis suitable for ordinary arbitrary-deadline sporadic task sets, i.e., without parallelism.

cs.OS↗

arXiv2017

POSIX-based Operating System in the environment of NVM/SCM memory

Modern Operating Systems are typically POSIX-compliant. The system calls are the fundamental layer of interaction between user-space applications and the OS kernel and its implementation of fundamental abstractions and primitives used in modern computing. The next generation of NVM/SCM memory raises critical questions about the efficiency of modern OS architecture. This paper investigates how the POSIX API drives performance for a system with NVM/SCM memory. We show that OS and metadata related system calls represent the most important area of optimization. However, the synchronization related system calls (poll(), futex(), wait4()) are the most time-consuming overhead that even a RAMdisk platform fails to eliminate. Attempting to preserve the POSIX-based approach will likely result in fundamental inefficiencies for any future applications of NVM/SCM memory.

cs.OS↗

arXiv2018

Protecting real-time GPU kernels on integrated CPU-GPU SoC platforms

Integrated CPU-GPU architecture provides excellent acceleration capabilities for data parallel applications on embedded platforms while meeting the size, weight and power (SWaP) requirements. However, sharing of main memory between CPU applications and GPU kernels can severely affect the execution of GPU kernels and diminish the performance gain provided by GPU. For example, in the NVIDIA Tegra K1 platform which has the integrated CPU-GPU architecture, we noticed that in the worst case scenario, the GPU kernels can suffer as much as 4X slowdown in the presence of co-running memory intensive CPU applications compared to their solo execution. In this paper, we propose a software mechanism, which we call BWLOCK++, to protect the performance of GPU kernels from co-scheduled memory intensive CPU applications.

cs.PF↗

arXiv2018

Connecting the World of Embedded Mobiles: The RIOT Approach to Ubiquitous Networking for the Internet of Things

The Internet of Things (IoT) is rapidly evolving based on low-power compliant protocol standards that extend the Internet into the embedded world. Pioneering implementations have proven it is feasible to inter-network very constrained devices, but had to rely on peculiar cross-layered designs and offer a minimalistic set of features. In the long run, however, professional use and massive deployment of IoT devices require full-featured, cleanly composed, and flexible network stacks. This paper introduces the networking architecture that turns RIOT into a powerful IoT system, to enable low-power wireless scenarios. RIOT networking offers (i) a modular architecture with generic interfaces for plugging in drivers, protocols, or entire stacks, (ii) support for multiple heterogeneous interfaces and stacks that can concurrently operate, and (iii) GNRC, its cleanly layered, recursively composed default network stack. We contribute an in-depth analysis of the communication performance and resource efficiency of RIOT, both on a micro-benchmarking level as well as by comparing IoT communication across different platforms. Our findings show that, though it is based on significantly different design trade-offs, the networking subsystem of RIOT achieves a performance equivalent to that of Contiki and TinyOS, the two operating systems which pioneered IoT software platforms.

cs.NI↗

arXiv2018

Shai: Enforcing Data-Specific Policies with Near-Zero Runtime Overhead

Data retrieval systems such as online search engines and online social networks must comply with the privacy policies of personal and selectively shared data items, regulatory policies regarding data retention and censorship, and the provider's own policies regarding data use. Enforcing these policies is difficult and error-prone. Systematic techniques to enforce policies are either limited to type-based policies that apply uniformly to all data of the same type, or incur significant runtime overhead. This paper presents Shai, the first system that systematically enforces data-specific policies with near-zero overhead in the common case. Shai's key idea is to push as many policy checks as possible to an offline, ahead-of-time analysis phase, often relying on predicted values of runtime parameters such as the state of access control lists or connected users' attributes. Runtime interception is used sparingly, only to verify these predictions and to make any remaining policy checks. Our prototype implementation relies on efficient, modern OS primitives for sandboxing and isolation. We present the design of Shai and quantify its overheads on an experimental data indexing and search pipeline based on the popular search engine Apache Lucene.

cs.CR↗

arXiv2018

vLibOS: Babysitting OS Evolution with a Virtualized Library OS

Many applications have service requirements that are not easily met by existing operating systems. Real-time and security-critical tasks, for example, often require custom OSes to meet their needs. However, development of special purpose OSes is a time-consuming and difficult exercise. Drivers, libraries and applications have to be written from scratch or ported from existing sources. Many researchers have tackled this problem by developing ways to extend existing systems with application-specific services. However, it is often difficult to ensure an adequate degree of separation between legacy and new services, especially when security and timing requirements are at stake. Virtualization, for example, supports logical isolation of separate guest services, but suffers from inadequate temporal isolation of time-critical code required for real-time systems. This paper presents vLibOS, a master-slave paradigm for new systems, whose services are built on legacy code that is temporally and spatially isolated in separate VM domains. Existing OSes are treated as sandboxed libraries, providing legacy services that are requested by inter-VM calls, which execute with the time budget of the caller. We evaluate a real-time implementation of vLibOS. Empirical results show that vLibOS achieves as much as a 50\% reduction in performance slowdown for real-time threads, when competing for a shared memory bus with a Linux VM.

cs.OS↗

arXiv2018

Mirrored and Hybrid Disk Arrays: Organization, Scheduling, Reliability, and Performance

Basic mirroring (BM) classified as RAID level 1 replicates data on two disks, thus doubling disk access bandwidth for read requests. RAID1/0 is an array of BM pairs with balanced loads due to striping. When a disk fails the read load on its pair is doubled, which results in halving the maximum attainable bandwidth. We review RAID1 organizations which attain a balanced load upon disk failure, but as shown by reliability analysis tend to be less reliable than RAID1/0. Hybrid disk arrays which store XORed instead of replicated data tend to have a higher reliability than mirrored disks, but incur a higher overhead in updating data. Read request response time can be improved by processing them at a higher priority than writes, since they have a direct effect on application response time. Shortest seek distance and affinity based routing both shorten seek time. Anticipatory arm placement places arms optimally to minimize the seek distance. The analysis of RAID1 in normal, degraded, and rebuild mode is provided to quantify RAID1/0 performance. We compare the reliability of mirrored disk organizations against each other and hybrid disks and erasure coded disk arrays.

cs.DC↗

arXiv2019

Virtual Breakpoints for x86/64

Efficient, reliable trapping of execution in a program at the desired location is a linchpin technique for dynamic malware analysis. The progression of debuggers and malware is akin to a game of cat and mouse - each are constantly in a state of trying to thwart one another. At the core of most efficient debuggers today is a combination of virtual machines and traditional binary modification breakpoints (int3). In this paper, we present a design for Virtual Breakpoints. a modification to the x86 MMU which brings breakpoint management into hardware alongside page tables. In this paper we demonstrate the fundamental abstraction failures of current trapping methods, and design a new mechanism from the hardware up. This design incorporates lessons learned from 50 years of virtualization and debugger design to deliver fast, reliable trapping without the pitfalls of traditional binary modification.

cs.OS↗

arXiv2018

Representation Learning for Resource Usage Prediction

Creating a model of a computer system that can be used for tasks such as predicting future resource usage and detecting anomalies is a challenging problem. Most current systems rely on heuristics and overly simplistic assumptions about the workloads and system statistics. These heuristics are typically a one-size-fits-all solution so as to be applicable in a wide range of applications and systems environments. With this paper, we present our ongoing work of integrating systems telemetry ranging from standard resource usage statistics to kernel and library calls of applications into a machine learning model. Intuitively, such a ML model approximates, at any point in time, the state of a system and allows us to solve tasks such as resource usage prediction and anomaly detection. To achieve this goal, we leverage readily-available information that does not require any changes to the applications run on the system. We train recurrent neural networks to learn a model of the system under consideration. As a proof of concept, we train models specifically to predict future resource usage of running applications.

cs.DC↗