System, method, and tangible computer-readable storage media are disclosed for providing a brokering service for compute resources The method includes, at a brokering service, polling a group of separately administered compute environments to identify resource capabilities and information, each compute resource environment including the group of managed nodes for processing workload, receiving a request for compute resources at the brokering service system, the request for compute resources being associated with a service level agreement (SLA) and based on the resource capabilities across the group of compute resource environments, selecting compute resources in one or more of the group of compute resource environments The brokering service system receives workload associated with the request and communicates the workload to the selected resources for processing The brokering services system can aggregate resources for multiple cloud service providers and act as an advocate for or a guarantor of the SLA associated with the workload

System and method of brokering cloud computing resources

Systems code is often written in low-level languages like C/C++, which offer many benefits but also delegate memory management to programmers. This invites memory safety bugs that attackers can exploit to divert control flow and compromise the system. Deployed defense mechanisms (e.g., ASLR, DEP) are incomplete, and stronger defense mechanisms (e.g., CFI) often have high overhead and limited guarantees [19, 15, 9].We introduce code-pointer integrity (CPI), a new design point that guarantees the integrity of all code pointers in a program (e.g., function pointers, saved return addresses) and thereby prevents all control-flow hijack attacks, including return-oriented programming. We also introduce code-pointer separation (CPS), a relaxation of CPI with better performance properties. CPI and CPS offer substantially better security-to-overhead ratios than the state of the art, they are practical (we protect a complete FreeBSD system and over 100 packages like apache and postgresql), effective (prevent all attacks in the RIPE benchmark), and efficient: on SPEC CPU2006, CPS averages 1.2% overhead for C and 1.9% for C/C++, while CPI's overhead is 2.9% for C and 8.4% for C/C++.A prototype implementation of CPI and CPS can be obtained from http://levee.epfl.ch.

/pdf/code-pointer-integrity-2gu5mwg209.pdf

Code-pointer integrity

Although chip-multiprocessors have become the industry standard, developing parallel applications that target them remains a daunting task. Non-determinism, inherent in threaded applications, causes significant challenges for parallel programmers by hindering their ability to create parallel applications with repeatable results. As a consequence, parallel applications are significantly harder to debug, test, and maintain than sequential programs.This paper introduces Kendo: a new software-only system that provides deterministic multithreading of parallel applications. Kendo enforces a deterministic interleaving of lock acquisitions and specially declared non-protected reads through a novel dynamically load-balanced deterministic scheduling algorithm. The algorithm tracks the progress of each thread using performance counters to construct a deterministic logical time that is used to compute an interleaving of shared data accesses that is both deterministic and provides good load balancing. Kendo can run on today's commodity hardware while incurring only a modest performance cost. Experimental results on the SPLASH-2 applications yield a geometric mean overhead of only 16% when running on 4 processors. This low overhead makes it possible to benefit from Kendo even after an application is deployed. Programmers can start using Kendo today to program parallel applications that are easier to develop, debug, and test.

/pdf/kendo-efficient-deterministic-multithreading-in-software-4r45j0zery.pdf

Kendo: efficient deterministic multithreading in software

http://gauss.ececs.uc.edu/Courses/c6055/lectures/PDF/sec_virt_for_cld.pdf

Secure virtualization for cloud computing

We present two asynchronous Byzantine fault-tolerant state machine replication (BFT) algorithms, which improve previous algorithms in terms of several metrics. First, they require only 2f+1 replicas, instead of the usual 3f+1. Second, the trusted service in which this reduction of replicas is based is quite simple, making a verified implementation straightforward (and even feasible using commercial trusted hardware). Third, in nice executions the two algorithms run in the minimum number of communication steps for nonspeculative and speculative algorithms, respectively, four and three steps. Besides the obvious benefits in terms of cost, resilience and management complexity-fewer replicas to tolerate a certain number of faults-our algorithms are simpler than previous ones, being closer to crash fault-tolerant replication algorithms. The performance evaluation shows that, even with the trusted component access overhead, they can have better throughput than Castro and Liskov's PBFT, and better latency in networks with nonnegligible communication delays.

/pdf/efficient-byzantine-fault-tolerance-2vxbsceutp.pdf

Efficient Byzantine Fault-Tolerance

This paper presents Emusphere, an integrated emulation platform for the efficient evaluation of planetary-scale distributed systems. It allows system developers and architects to assess their systems in an environment that is able to provision any desired computation infrastructure, mimic realistic environmental conditions, and carry out arbitrary usage scenarios. Unlike existing testbeds which suffer from technical complexity and high bootstrapping efforts, Emusphere is an easy-to-use and fully automated environment. This is achieved by reducing the complete configuration and execution efforts down to the definition of a single configuration file that defines the structure and course of the experiments. Those Experiment Descriptors are executed using Emusphere Executors which utilize resource providers to provision any specified virtual infrastructure, run the defined experiment steps, collect the results and finally tear down the whole environment. In this way experiments can be easily modified, reproduced, transferred and verified. We also provide an evaluation which shows that our approach surpasses existing solutions in terms of flexibility and usability while offering a high degree of scalability.

Emusphere: Evaluating Planetary-Scale Distributed Systems in Automated Emulation Environments

Nowadays, privacy and anonymity are becoming more and more important for users of social networks. Thus, it is of particular interest for user of an anonymous, location-based social network if the network is able to provided the anonymity that it appears to provide. In this work, we present an approach to obtain the geographic location of users of the popular Jodel social network. We are able to reconstruct the exact location from which a message was sent with an accuracy of 10 meters, using only 20 requests sent from virtual clients at different locations to the social network service.

Geographic Localization of an Anonymous Social Network Message Data Set

The objective of the 13th edition of Ph Doctoral Students in Object-Oriented Systems workshop (PHDOOS) was to offer an opportunity for PhD students to meet and share their research experiences, and to discover commonalities in research and student ship. In this way, the participants may receive insightful comment about their research, learn about related work and initiate future research collaborations. So, PHDOOS is a gauge to detect hot spots in current lines of research and new avenues of work in objects-oriented concepts.

Workshop for PhD Students in Object Oriented Programming

Virtual machine introspection (VMI) allows a monitoring application, usually running in a separate virtual machine on the same host, to peek into another guest virtual machine running on the same host, check and modify both registers and memory state of the guest. It has gained popularity in malware analysis, software reverse engineering, and intrusion detection systems. However, VMI comes with a huge overhead, which not only is a waste of resources but also can tip malware that VMI is being used.

Introspect Virtual Machines Like It Is the Linux Kernel

Data streaming platforms connect heterogeneous services through the publish-subscribe paradigm. Currently available platforms provide protection against crash faults, but are not resistant against Byzantine faults like arbitrary hardware faults and intrusions. State machine replication can provide this protection, but the higher resource requirements and the more elaborate communication primitives usually result in a higher overall complexity and a non-negligible performance degradation. As data streaming operates on highly-partitionable append-only state, some of these performance losses can be counteracted by applying speculative execution and sharding. We show the effectiveness of these concepts in a prototype implementation, which only results in a reasonable drop in system throughput and latency during average system utilization, when compared to state-of-the-art data streaming platforms like Apache Kafka, while providing stronger resilience guarantees.

Hans P. Reiser

Papers

Emusphere: Evaluating Planetary-Scale Distributed Systems in Automated Emulation Environments

Geographic Localization of an Anonymous Social Network Message Data Set

Workshop for PhD Students in Object Oriented Programming

Introspect Virtual Machines Like It Is the Linux Kernel

SmartStream: towards efficient byzantine resilient data streaming through speculation and sharding