Chunhua Li

Implementing and Evaluating Security Controls for an Object-Based Storage System

This paper presents the implementation and performance evaluation of a real, secure object-based storage system compliant to the T10 OSD standard. In contrast to previous work, our system implements the entire three security methods of the OSD security protocol defined in the standard, namely CAPKEY, CMDRSP and ALLDATA, and an Oakley-based authentication protocol by which the Metadata Server (MDS) and client can be sure of each others identities. Moreover, our system supports concurrent operations from multiple clients to multiple OSDs. The MDS, a combination of security manager and storage/policy manager, performs access control, global namespace management, and concurrency control. We also evaluate the performance and scalability of our implementation and compare it with iSCSI, NFS and Lustre storage configurations. The overhead of access control is small: compared with the same system without any security mechanism, bandwidth for reads and writes with the CAPKEY and CMDRSP methods decreases by less than 5%, while latency for metadata operations with any of the security methods increases by less than 0.3 ms (5%). The system with the ALLDATA method suffers a higher performance penalty: large sequential accesses run at 46% and 52% of the maximum bandwidth of unsecured storage for reads and writes respectively. The aggregate throughput scales with the number of OSDs (up to 8 in our experiments). The overhead of the SET KEY commands for partition and working keys refreshed frequently is less than 2 ms.

An image watermarking technique based on support vector regression

A new image watermarking technique based on support vector regression (SVR) is proposed in this paper. It uses support vector machine (SVM) to embed the watermark and gains satisfying results. Due to the good learning and generalization capability in the processing of small-sample learning problems, SVR can well memorize the relationship between the random selected pixel and its neighboring pixels in an image. Then, a bit of the watermark is embedded or extracted by adjusting or comparing the relation between the embedded pixel and the output of the trained SVR. Extensive experimental results show that the SVM is much more suitable than the neural network to model the relationship among the neighboring pixels, and the proposed technique possesses good visual perception and high robustness to common image processing and the JPEG compression, and also has high security and practicability.

Full integrity and freshness for cloud data

Abstract Data outsourcing relieves cloud users of the heavy burden of infrastructure management and maintenance. However, the handover of data control to untrusted cloud servers significantly complicates the security issues. Conventional signature verification widely adopted in cryptographic storage systems only guarantees the integrity of retrieved data, for those rarely or never accessed data, it does not work. This paper integrates proof of storage technique with data dynamics support into cryptographic storage design to provide full integrity for outsourced data. Besides, we provide instantaneously freshness check for retrieved data to defend against potential replay attacks. We achieve these goals by designing flexible block structures and combining broadcast encryption, key regression, Merkle hash tree and proof of storage together to provide a secure storage service for outsourced data. Experimental evaluation of our prototype shows that the cryptographic cost and throughput are reasonable and acceptable.

State-based steganography in low bit rate speech

Common least significant bit (LSB) relevant steganography methods in speech frames often base on bits evaluation by certain speech quality evaluation criterion and together with some coding and embedding strategies to enhance imperceptibility and efficiency. However, some embedding capabilities and security strategy are neglected. This paper proposes a state-based steganography method which fully investigates speech frame features in order to expand embedding capabilities and enhance steganography security. In the proposed method, embedding capabilities are measured by available numbers of states relative to current frame parameters rather than information bits. And secret information embedding procedure is performed by the chosen states mapped operations. This is a basic fine-grained steganography solution which is useful for other algorithms based on it. The experimental results have demonstrated that statebased method outperforms traditional LSB substitution in overall performance and introduces limited latency, which meets the realtime requirement in covert communications.

SVR-parameters selection for image watermarking

An image digital watermarking technique using support vector regression (SVR) is proposed and researched in this paper. Firstly, the method of embedding and extracting watermarking from digital image is given. Then, the influence of SVR-learning parameters on the watermarking performance is analyzed, and the ideal value range of SVR-learning parameters for different images is given respectively. Finally, the results are validated with other images. Experimental results show that this technique can obtain good watermarking performance as well as good learning performance when RBF kernel is adopted with its width a from 8 to 10, balanceable parameter C from 0.8 to 1, insensitive parameter s from 0.008 to 0.01 respectively

Application Research on Support Vector Machine in Image Watermarking

As the good learning ability and generalization capacity, support vector machine (SVM) which based on the statistical learning theory is increasingly noticed by many researchers. Although SVM has many prominent theoretical advantages, its application still drops behind. In this paper, a new application of SVM is studied. Firstly, the strategy of embedding and extracting watermark using support vector regression (SVR) from a digital image is given. Then, the influences of SVR-learning parameters on the watermarking performance are analyzed, and the ideal values range of SVR-learning parameters for different images is given respectively. Finally, the results are validated with other images and compared with the similar method. Experimental results show that SVM can be successfully fused with conventional watermarking technique to improve the robustness and imperceptibility of watermark with the help of sound SVR-learning parameters

LAMS: A latency-aware memory scheduling policy for modern DRAM systems

This paper introduces a new memory scheduling policy called LAMS, which is inspired by a recently proposed memory architecture and targets for future high capacity memory systems. As memory capacity increases, the bit-lines connected to memory row buffers become much longer, dramatically lengthening memory access latency, due to increased parasitic capacitance. Recent study has proposed to partition long bit-lines into near and far (relative to the row buffer) segments via inserting isolation transistors such that access to near segment can be accomplished much faster, while access to far segment remains nearly the same. However, how to effectively leverage the new memory architecture still remains unexplored. We suggest to take advantage of this new memory architecture via performing latency-aware memory scheduling for pending requests to explore their performance potentials. In this scheduling policy, each memory request is classified to one of the following three categories, row-buffer hit, near-buffer, and far-buffer. Based on the classification, it issues requests in the order of row-buffer hit → near-buffer → far-buffer. In doing so, it avoids long-latency requests blocking short-latency memory requests, reducing total memory queuing time in the memory controller and improving overall memory performance. Our evaluation results on a simulated memory system show that comparing with the commonly used FR-FCFS scheduler, our LAMS improves performance and energy efficiency by up to 20.6% and 34%, respectively. Even comparing with the four competitive schedulers chosen from memory scheduling champion (MSC), LAMS still improves performance and energy efficiency by up to 6.1% and 23.4%, respectively.

Improve Effective Capacity and Lifetime of Solid State Drives

Flash-based SSDs are becoming increasingly popular in modern storage systems, especially in high-performance computing infrastructures. However, several inherent technical limitations still remain to prevent their widespread deployment. One of the critical concerns is their limited lifetime, which is directly relevant to the total writes experienced by SSDs. In this paper, we present a Content and semantics Aware File System (CSA-FS) which is able to reduce write traffic to SSDs. It employs deduplication and delta-encoding techniques to file system data blocks and semantic blocks, respectively. It is motivated by two important observations: (1) there exists a huge amount of content redundancy within primary storage systems, and (2) semantic blocks are visited much more frequently than data blocks, with each update bringing very minimal changes. By separately deduplicating redundant data blocks and delta-encoding similar semantic blocks, CSA-FS can significantly reduce the total write traffic to SSDs and greatly improve their lifetime correspondingly, at an acceptable cost of at most 7% performance degradation across a variety of workloads.

An Empirical Study on the Interplay between Filesystems and SSD

This study presents a comprehensive empirical investigation on the interplay between actively-deployed file systems and an SSD. We test and analyze the performance of four widely used Linux file systems, which are ext2, ext3, XFS and Reiserfs, on an SSD with a range of different workloads. It is primarily intended to serve two purposes. One is that considering its widespread adoption trend, we are realistically motivated to have first-hand numbers of the actual performance of the emerging storage technology, especially in the contexts of daily deployment scenarios. The other goal is that we attempt to disclose the internal details behind the SSDs thin interface from a high-level perspective, totally different than those previous studies, which are typically micro-testonly. As a result of this study, we obtain several interesting and useful findings: (1) Generally, different file systems perform disparately on the SSD due to their various design principles, sometimes even with up to one order of magnitude of performance discrepancy. (2) File system format/mount options and workload characteristics have significant impacts on performance. (3) SSD would deliver optimal performance if used in a friendly manner. (4) Workloads, file systems and SSD interact in an intrinsically complicated way and in order to have optimal synergistic performance anticipation, users should seriously consider all of the three factors together, when setting up their SSD-based storage systems.

Adopting Multi-mode Access Control for Secure Data Sharing in Cloud

Cloud data sharing introduces a new challenge to the enforcement of security controls. The existing approaches are not flexible and low efficiency while performing access control. In this paper, we propose a multi-mode access control scheme, which can support multiple access strategies for data distributed at different areas in cloud. Meanwhile, we introduce the concept of dynamic attribute into the access policy to adjust user’s access privileges timely according to his changeable characteristics. Specifically, we present an efficient revocation method which uses confusion token to process the ciphertext at the server. We apply these techniques to design a muti-mode access control system and implement the prototype based on the Openstack platform. Furthermore, we devise a Uniform Access Control Markup Language (UACML) based on XACML, which greatly improves the expressiveness of our multi-mode access control policies. The experimental results show that our scheme has low computational overhead for revocation as well as good flexibility.