Ki-Woong Park

THEMIS: A Mutually Verifiable Billing System for the Cloud Computing Environment

With the widespread adoption of cloud computing, the ability to record and account for the usage of cloud resources in a credible and verifiable way has become critical for cloud service providers and users alike. The success of such a billing system depends on several factors: The billing transactions must have integrity and nonrepudiation capabilities; the billing transactions must be nonobstructive and have a minimal computation cost; and the service level agreement (SLA) monitoring should be provided in a trusted manner. Existing billing systems are limited in terms of security capabilities or computational overhead. In this paper, we propose a secure and nonobstructive billing system called THEMIS as a remedy for these limitations. The system uses a novel concept of a cloud notary authority for the supervision of billing. The cloud notary authority generates mutually verifiable binding information that can be used to resolve future disputes between a user and a cloud service provider in a computationally efficient way. Furthermore, to provide a forgery-resistive SLA monitoring mechanism, we devised a SLA monitoring module enhanced with a trusted platform module (TPM), called S-Mon. The performance evaluation confirms that the overall latency of THEMIS billing transactions (avg. 4.89 ms) is much shorter than the latency of public key infrastructure (PKI)-based billing transactions (avg. 82.51 ms), though THEMIS guarantees identical security features as a PKI. This work has been undertaken on a real cloud computing service called iCubeCloud.

Computationally Efficient PKI-Based Single Sign-On Protocol, PKASSO for Mobile Devices

In an attempt to expand Public Key Infrastructure (PKI) usage to a ubiquitous and mobile computing environment, we found that the deployment of the PKI on a resource-constrained device such as an 8-bit microprocessor leads to user-obstructive latency or additional circuitry for the operations. To alleviate these limitations, we propose a new PKI-based authentication protocol and security infrastructure, namely, PKASSO, which is enhanced with the single sign-on and delegation technology that is used especially for mobile devices with restricted computation power. PKASSO offloads complex PKI operations from the mobile devices to the infrastructure so as to keep the hardware and software complexity of the devices as low as possible. In addition, even though a conventional delegation mechanism cannot support a nonrepudiation mechanism against malicious user behavior, PKASSO can provide such a mechanism by devising a referee server that, on one hand, generates binding information between a device and authentication messages and, on the other hand, retains the information in its local storage for future accusation. We present the detailed design and performance evaluation of PKASSO and offer a protocol analysis in terms of user authentication latency and the completeness of the protocol. According to the performance evaluation, the authentication latency of our infrastructure (which averages 0.082 second) is much shorter than the authentication latency of a conventional PKI-based authentication latency (which averages 5.01 seconds).

Efficient page caching algorithm with prediction and migration for a hybrid main memory

Emerging next generation memories, NVRAMs, such as Phase-change RAM (PRAM), Ferroelectric RAM (FRAM), and Magnetic RAM (MRAM) are rapidly becoming promising candidates for large scale main memory because of their high density and low power consumption. Many researchers have attempted to construct a main memory with NVRAMs, in order to make up for the limits of NVRAMs. However, we find that the preexisting page caching algorithms, such as LRU, LIRS, and CLOCK-Pro, are often sub-optimal for NVRAMs due to its DRAM-oriented design including uniform access latency and unlimited endurance. Consequently, the algorithms cannot be directly adapted to the hybrid main memory architecture with PRAM. To mitigate this design limitation, we propose a new page caching algorithm for the hybrid main memory. It is designed to overcome the long latency and low endurance of PRAM. On the basis of the LRU replacement algorithm, we propose a prediction of page access pattern and migration schemes to maintain write-bound access pages to DRAM. The experiment results have convinced us that our page caching algorithm minimizes the number of the write access of PRAM while maintaining the cache hit ratio. The results show that we can reduce the total write access count by a maximum of 52.9% and the consumed energy by 19.9%. Therefore, we can enhance the average page cache performance and reduce the endurance problem in the hybrid main memory.

A Ubiquitous Fashionable Computer with an i-Throw Device on a Location-Based Service Environment

The ubiquitous fashionable computer (UFC), introduced in this paper, is a wearable computer that allows people to exploit ubiquitous computing environment in a user-friendly manner. We present the design approach and philosophy of the UFC that is wearable, aesthetic, and intuitive. The UFC supports the interoperability of various communication interfaces among WLAN, Bluetooth and ZigBee devices. We developed a wireless gesture recognition device, called i -Throw, which is small enough to be worn on ones finger like a ring. The UFC, with the help of i -Throw, can control ubiquitous environment using an intuitive hand motion. To explain the practical use of the UFC platform and the user-friendly interaction with ubiquitous environment, we implemented a ubiquitous testbed where multiple UFC users interact with various ubiquitous devices or other UFC users. In addition, we implemented a practical application which makes it possible to exchange the various objects and control ubiquitous devices very easily.

THEMIS: Towards Mutually Verifiable Billing Transactions in the Cloud Computing Environment

The ability to record and keep account of the usage of cloud resources in a credible and verifiable way is a precursor to widespread cloud deployment and availability because usage information is potentially sensitive and must be verifiably accurate. In an attempt to provide a mutually verifiable resource usage and billing mechanism, we found that the frequent asymmetric key operations of a digital signature lead to excessive computations and a bottleneck of billing transactions. As a remedy for these limitations, we propose a mutually verifiable billing system called THEMIS. The system, which introduces the concept of a cloud notary authority for the supervision of billing, makes billing more objective and acceptable to users and cloud service providers. THEMIS generates mutually verifiable binding information that can be used to resolve future disputes between a user and a cloud service provider. Because THEMIS does not require any asymmetric key operations of users and providers, it provides a level of security that is identical to that of a Public Key Infrastructure (PKI) and it minimizes the latency of billing transactions. This work has been undertaken on a real cloud computing service called iCube Cloud.

pKASSO: Towards Seamless Authentication Providing Non-Repudiation on Resource-Constrained Devices

PKI is generally considered as the most appropriate solution for e-commerce and mutual authentication, owing to its digital signature and non-repudiation features. Asymmetric key operations of PKI require by far more CPU cycles than a symmetric cryptographic algorithm. It hampers the usability of PKI on resource-constrained devices. To overcome these limitations, we propose a new PKI- based authentication protocol and security infrastructure enhanced with single sign-on and delegation technology for a device with a restricted computing power. Although a conventional delegation mechanism cannot support non-repudiation mechanism against malicious users behavior, our proposed protocol and security infrastructure can provide the mechanism by devising a referee server that generates binding information between a device and authentication messages, and retains the information in its local storage for future accusation.

HyperDealer: Reference-Pattern-Aware Instant Memory Balancing for Consolidated Virtual Machines

Memory contention among consolidated virtual machines (VMs) creates the need for a memory balancing operation. In an attempt to provide a prompt memory balancing mechanism, we found problems with the retardation of memory transfer by the reclamation delay. The scheduling of the VMs generates the delay, and a conflicts of two reclamation policies between the guest OS and the hypervisor deteriorates it. As a remedy to these problems, we propose HyperDealer, which selects the victim page by applying reference patterns, reclaims the pages with hypervisor-level paging, and transfers those pages with ballooning of the guest OS. Our scheme eliminates the involvement of the victim VM in memory balancing and extends the dwell time of reclaimed pages in the reclaimed state. Consequently, HyperDealer significantly reduces the time taken to transfer memory with a low overhead and enhances the value of additional memory for the recipient VM. The experimental results of our scheme show that the application performance in the recipient VM is 11% more time-efficient and has a penalty which is 50% less than previous approaches.

OPAMP: Evaluation Framework for Optimal Page Allocation of Hybrid Main Memory Architecture

Main memory as a hybrid between DRAM and nonvolatile memory is rapidly considered as a basic building block of computing systems. Despite widely-performed researches no one can confirm whether hybrid memory is at its full performance in terms of energy consumption, time delay or both. The main problem is that evaluating their performance in comparison with the optimal performance is challenging since deriving the optimal value is NP-complete. In this paper, we design and implement an evaluation framework termed OPAMP, which calculates optimal performance of the hybrid memory environment. This system gathers workload, specification of DRAM and PRAM, and environmental parameters of the hybrid main memory. After that, it calculates the maximum performance under the corresponding conditions. We suggest the way of deriving the optimal value by profiling instead of page migration which is the mainstream of recent researches on hybrid main memory system. Also, proportion of DRAMs size to PRAMs and proportion of DRAMs usage space to PRAMs are impactive factors. While designing hybrid main memory, those two variables must be determined carefully and OPAMP gives the guideline to the researchers.

MN-Mate: Resource Management of Manycores with DRAM and Nonvolatile Memories

The advent of many core era breaks the performance wall but it causes severe energy consumption. NVRAM as a main memory can be a good solution to reduce energy consumption due to large size of DRAM. In this paper, we propose MN-MATE, a novel architecture and management techniques for resource allocation of a number of cores and large size of DRAM and NVRAM. In MN-MATE, a hyper visor partitions and allocates cores and memory for guest OSes dynamically. It is clear that optimized matching of heterogeneous cores, DRAM, and NVRAM enhances system performance. Selective locating of data in a main memory composed of DRAM and NVRAM significantly reduces energy consumptions. Preliminary results show that integration of dynamic resource partitioning and selective memory allocation scheme with MN-MATE reduces energy usage significantly and suppresses performance loss from NVRAM’s characteristics.

GHOST: GPGPU-offloaded high performance storage I/O deduplication for primary storage system

Data deduplication has been an effective way to eliminate redundant data mainly for backup storage systems. Since the recent primary storage systems in cloud services are expected to have the redundancy, the deduplication technique can also bring significant cost saving for the primary storage. However, the primary storage system requires high performance requirement about several GBs per second. Most conventional deduplication techniques targeted the performance requirement of 200-300MB/s. In an attempt to achieve a high performance storage deduplication system at the primary storage, we thoroughly analyze the performance bottleneck of previous deduplication systems to enhance the system to meet the requirement of the primary storage. The new performance bottleneck of deduplication in the primary storage lies on not only key-value store lookup, also computation for data segmentation and fingerprinting due to recent technology improvement of flash devices such as SSD. To overcome the bottlenecks, we propose a new deduplication system utilizing GPGPU. Our proposed system, termed GHOST, includes the followings to offload and optimize the deduplication processing in GPGPU: (1) In-Host Data Cache, (2) Destage-aware Data offloading to GPGPU and (3) In-GPGPU Table Cache of key-value store. These techniques improve the offloaded deduplication processing about 10-20% on the reasonable workload of the primary storage compared to the naive approach. Our proposed deduplication system can achieve 1.5GB/s in maximum which is about 5 times of the deduplication systems used CPU only.