Marcel-Catalin Rosu

Highly-Scalable Searchable Symmetric Encryption with Support for Boolean Queries

This work presents the design and analysis of the first searchable symmetric encryption (SSE) protocol that supports conjunctive search and general Boolean queries on outsourced symmetrically- encrypted data and that scales to very large databases and arbitrarily-structured data including free text search. To date, work in this area has focused mainly on single-keyword search. For the case of conjunctive search, prior SSE constructions required work linear in the total number of documents in the database and provided good privacy only for structured attribute-value data, rendering these solutions too slow and inflexible for large practical databases.

The effects of wide-area conditions on WWW server performance

WWW workload generators are used to evaluate web server performance, and thus have a large impact on what performance optimizations are applied to servers. However, current benchmarks ignore a crucial component: how these servers perform in the environment in which they are intended to be used, namely the wide-area Internet.This paper shows how WAN conditions can affect WWW server performance. We examine these effects using an experimental test-bed which emulates WAN characteristics in a live setting, by introducing factors such as delay and packet loss in a controlled and reproducible fashion. We study how these factors interact with the host TCP implementation and what influence they have on web server performance. We demonstrate that when more realistic wide-area conditions are introduced, servers exhibit very different performance properties and scaling behaviors, which are not exposed by existing benchmarks running on LANs. We show that observed throughputs can give misleading information about server performance, and thus find that maximum throughput, or capacity, is a more useful metric. We find that packet losses can reduce server capacity by as much as 50 percent and increase response time as seen by the client. We show that using TCP SACK can reduce client response time, without reducing server capacity.

A survey of public Web Services

Enterprise IT infrastructures and their interfaces are migrating toward a service-oriented architecture, using Web Services (WS) as a de-facto implementation protocol. As a result, WS-generated traffic is expected to have a considerable impact on the Internet. Despite the high amount of interest in WS, there have been few studies regarding their characteristics. In this survey, we analyze publicly-accessible WS over a 9 month period. We study the evolution and distributions of the WS population, and message characteristics and response times of each WS. We also closely analyze two popular WS sites: Amazon and Google. Some of our initial results contradict common intuition. The number of public WS has not increased dramatically, although there are signs which indicate intensive ongoing activities in the WS domain. The geographic distribution of public WS is largely skewed. Most importantly, the sizes of WS responses and their variation are smaller than those of the existing Web objects.

On demand platform for online games

A shared infrastructure, based on emerging on demand computing models, that supports multiple games offers an attractive option for large-scale multiplayer online game providers who want to avoid the risk of investing in dedicated resources. In this paper, we describe a prototype implementation of a service platform for online games. The platform design follows the on demand computing paradigm. It offers integration using open standards and off-the-shelf software and embraces virtualization and simplification to enable sharing resources across games. We describe our experience with identifying appropriate performance metrics for provisioning game servers and with implementing reusable platform components that provide useful functionality for a variety of games.

Implementation of a service platform for online games

Large-scale multiplayer online games require considerable investment in hosting infrastructures. However, the difficulty of predicting the success of a new title makes investing in dedicated server and network resources very risky. A shared infrastructure based on utility computing models to support multiple games offers an attractive option for game providers whose core competency is not in managing large server deployments.In this paper we describe a prototype implementation of a shared, on demand service platform for online games. The platform builds on open standards and off-the-shelf software developed to support utility computing offerings for Web-based business applications. We describe our early experience with identifying appropriate performance metrics for provisioning game servers and with implementing the platform components that we consider essential for its acceptance.

Rich Queries on Encrypted Data: Beyond Exact Matches

We extend the searchable symmetric encryption (SSE) protocol of [Cash et al., Crypto’13] adding support for range, substring, wildcard, and phrase queries, in addition to the Boolean queries supported in the original protocol. Our techniques apply to the basic single-client scenario underlying the common SSE setting as well as to the more complex Multi-Client and Outsourced Symmetric PIR extensions of [Jarecki et al., CCS’13]. We provide performance information based on our prototype implementation, showing the practicality and scalability of our techniques to very large databases, thus extending the performance results of [Cash et al., NDSS’14] to these rich and comprehensive query types.

A-SOAP: Adaptive SOAP Message Processing and Compression

Adaptive SOAP (A-SOAP,) is a practical approach to SOAP message compression. A-SOAP separates mechanisms from policies and allows for incremental deployment. This paper focuses on its three underlying mechanisms: accelerating message composition, reducing parsing overheads, and compressing messages, which leverages the previous two mechanisms. In contrast to existing dictionary-based compression techniques, A- SOAP does not require dictionaries to be exchanged between the two endpoints in advance; its dictionaries are built incrementally, as the communication progresses. A- SOAP endpoints agree on the dictionary management policy using a mechanism similar to HTTP content negotiation, possibly using a dedicated HTTP header field. In experiments with short messages and a simple policy, an A-SOAP prototype reduces processing overheads by half and message sizes by an order of magnitude without increasing message latencies.

Inverted browser: a novel approach towards display symbiosis

In this paper we introduce the inverted browser, a novel approach to enable mobile users to view content from their personal devices on public displays. The inverted browser is a network service to start and control a browser that is then used to view the content. In contrast to a traditional Web browser, which runs on the client device and pulls content from a server, content is pushed to the inverted browser from a personal data source upon user input. This approach allows a wide variety of personal content to be viewed by facilitating symbiotic relationships between mobile devices and intelligent displays in the environment. Our initial inverted browser prototype is based on a Web services wrapper around a traditional Web browser. Our experiments show that the inverted browser approach is superior to other solutions in terms of user convenience, ease of use, energy consumption, and privacy, but interaction latencies need improvement

On network CoProcessors for scalable, predictable media services

This paper presents the embedded realization and experimental evaluation of a media stream scheduler on network interface (NI) CoProcessor boards. When using media frames as scheduling units, the scheduler is able to operate in real-time on streams traversing the CoProcessor, resulting in its ability to stream video to remote clients at real-time rates. This paper presents a detailed evaluation of the effects of placing application or kernel-level functionality, like packet scheduling on NIs, rather than the host machines to which they are attached. The main benefits of such placement are: 1) that traffic is eliminated from the host bus and memory subsystem, thereby allowing increased host CPU utilization for other tasks, and 2) that NI-based scheduling is immune to host-CPU loading, unlike host-based media schedulers that are easily affected even by transient load conditions. An outcome of this work is a proposed cluster architecture for building scalable media servers by distributing schedulers and media stream producers across the multiple NIs used by a single server and by clustering a number of such servers using commodity network hardware and software.

Sender coordination in the Distributed Virtual Communication Machine

The Distributed Virtual Communication Machine (DVCM) is an extensible communication architecture for tightly-coupled clusters of workstations (COWs) connected by high-speed networks. The DVCM is designed for off-the-shelf network interface cards equipped with communication coprocessors. Its main component is an active backplane implemented in firmware running on the coprocessors. This backplane can be extended with modules that implement application-specific-functionality and have access to some of the applications state. Consequently non-trivial collective computations can be implemented as DVCM extensions. We present a DVCM extension module that provides application-specific network flow control by coordinating the resource-competing components of a parallel application running on an ATM LAN. Our experiments show that this extension module helps eliminate message loss and achieve high link bandwidth utilization when there is significant link contention.