Erik J. Johnson

Is a bot at the controls?: Detecting input data attacks

The use of programmatically generated input data in place of human-generated input data poses problems for many computer applications in use today. Mouse clicks and keyboard strokes can automatically be generated to cheat in online games, or to perpetrate click fraud. The ability to discern whether input data was computationally generated instead of created by a human input device is therefore of paramount importance to these types of applications. This paper describes a method for detecting input data that was computationally modified or fabricated. This includes detecting data that was not directly generated by a physical human input device such as a keyboard or mouse. A prototype of this system was built on existing hardware and was shown to be effective at detecting attacks on a real application. This detection method is capable of addressing the majority of input-based attacks currently in use. When used in conjunction with a trusted peripheral, it offers a robust mechanism for ensuring a computer is not at the controls.

A programming environment for packet-processing systems: Design considerations

The programming environments-languages, compilers, and runtime systems -for NPs are in their infancy. At the same time, NPs represent a much larger trend in the processor industry: multicore, lightweight threaded architectures designed for throughput-driven applications. Once this trend hits the mainstream-programming marketplace, the need for a programming environment that is as easy to use as the programming environments for todays workstations and servers will become universally important to programmers. The Shangri-La architecture represents a complete programming environment for the domain of packet processing on multicore, lightweight threaded architectures in general, and NPs specifically. Shangri-La encompasses a language that exposes domain constructs instead of hardware constructs, keeping the programmer and code separate from architectural details; a sophisticated compiler complex that uses profile information to guide the mapping of code to processors and data structures to memory automatically; and runtime system to ensure maximum performance benefits in the face of fluctuating traffic conditions-both natural and malicious. Currently effort is being made on two major tasks: creating a prototype implementation of the proposed architecture, and researching the more difficult questions that will appear as development proceeds. The prototype system, which builds on the Open Research Compiler infrastructure and targets the Intel IXP2400 network processor, will provide a platform for further research and development.

Symerton--using virtualization to accelerate packet processing

The complexity of packet-processing applications continues to grow, with encryption, compression, and XML processing becoming common on packet-processing devices at the edge of enterprise and service provider networks. While performance remains a key differentiator for these devices, the complexity and rate of change in the supported applications has made general-purpose platforms an attractive alternative to ASICs and network processors. General-purpose platforms offer excellent programmability and a wealth of existing software, in the form of operating systems, libraries, and applications that can be used to build a packet-processing system; however, the performance of general-purpose operating systems is unacceptable for many environments. This has driven developers to either make derivative versions of existing operating systems or to use special-purpose operating systems with a less comprehensive and familiar library of existing software. As part of the Symerton project, we propose using virtualization to address these issues. We have designed a system that has a virtual machine dedicated to high-performance networking, and a virtual machine dedicated to hosting non-performance critical tasks in a general-purpose operating system. Using a proof-of-concept implementation, we show that the resulting system outperforms a general-purpose operating system by an average of 22% for a real networking application. We also discuss tradeoffs that will need to be considered in further development of systems using this design.

Framework for supporting multi-service edge packet processing on network processors

Network edge packet-processing systems, as are commonly implemented on network processor platforms, are increasingly required to support a rich set of services. These multi-service systems are also subjected to widely varying and unpredictable traffic. Current network processor systems do not simultaneously deal well with a variety of services and fluctuating workloads. For example, current methods of worst-case, static provisioning can meet performance requirements for any workload, but provisioning each service for its worst case reduces the total number of services that can be supported. Alternately, profile-driven automatic-partitioning compilers create efficient binaries for multi-service applications for specific workloads but they are sensitive to workload fluctuations. Run-time adaptation is a potential solution to this problem. With run-time adaptation, the mapping of services to system resources can be dynamically adjusted based on the workload. We have implemented an adaptive system that automatically changes the mapping of services to processors, and handles migration of services between different processor core types to match the current workload. In this paper we explain our adaptive system built on the Intelreg IXP2400 network processor. We demonstrate that it outperforms multiple different profile-driven compiled solutions for most workloads and performs within 20% of the optimal compiled solution for the remaining workloads.

A programming environment for packet-processing systems

The programming environments-languages, compilers, and runtime systems -for NPs are in their infancy. At the same time, NPs represent a much larger trend in the processor industry: multicore, lightweight threaded architectures designed for throughput-driven applications. Once this trend hits the mainstream-programming marketplace, the need for a programming environment that is as easy to use as the programming environments for todays workstations and servers will become universally important to programmers. The Shangri-La architecture represents a complete programming environment for the domain of packet processing on multicore, lightweight threaded architectures in general, and NPs specifically. Shangri-La encompasses a language that exposes domain constructs instead of hardware constructs, keeping the programmer and code separate from architectural details; a sophisticated compiler complex that uses profile information to guide the mapping of code to processors and data structures to memory automatically; and runtime system to ensure maximum performance benefits in the face of fluctuating traffic conditions-both natural and malicious. Currently effort is being made on two major tasks: creating a prototype implementation of the proposed architecture, and researching the more difficult questions that will appear as development proceeds. The prototype system, which builds on the Open Research Compiler infrastructure and targets the Intel IXP2400 network processor, will provide a platform for further research and development.