Phil Kearns

A secure unrestricted advanced systems laboratory

We present the design of a systems laboratory intended for advanced undergraduates and graduate students. The laboratory provides an environment in which students are given complete (root) control of systems with essentially unrestricted access to the Internet. This is achieved without jeopardizing the security of the departmental network of which the laboratory is a part. Students in the laboratory are also given a secure environment in which to do their work. Such a laboratory is most valuable in advanced courses in operating systems and networks in which students implement and evaluate algorithms and policies subjected to real workloads. It is also valuable as a facility for research on systems and network topics, providing an open, yet safe, environment in which to work.

Global predicates in rough real time

Evaluation of predicates on the state of a distributed system is complicated by the lack of either a common clock or common memory. In these systems, message passing is often used to order local events globally. This leads to a partial, causal ordering of system events. Predicate evaluation algorithms based on this causal ordering generally cannot determine if an unstable predicate was true at some instant of real time without freezing the underlying application. They only determine whether or not the predicate could have occurred. This ordering is sufficient for evaluating stable predicates, but algorithms based on it require a good deal of message passing. We present two algorithms which conclusively evaluate both stable and a restricted class of unstable predicates for a given execution. The algorithms are based on the use of roughly synchronized clocks. We present an algorithm for scheduled evaluation as well as a centralized detection algorithm.

Immediate ordered service in distributed systems

A technique is presented by which a centralized service facility in a distributed system can honor client requests in the global order in which those requests were made. Unlike traditional approaches to this problem, the server provides immediate service to its clients. Immediate service requires that, upon receipt of a request which is the oldest unserved message, the server must grant the service immediately. No additional message passing may be used by the server in order to serve that request. The approach requires that certain information be appended to every message in the system. This piggybacked information allows the server to infer the order in which service should be granted to arriving request messages. Increased message length is thus explicitly traded for fewer messages and faster response to requests at the server. That overhead is proportional to the number of processors in the system. In time-critical distributed applications immediate service offers a means by which service response time can be substantially reduced. It is argued that, under certain reasonable assumptions about the network and process behavior, immediate service can outperform the logical timestamp approach for very large systems (and certainly for small systems).<<ETX>>

An implementation of flush channels based on a verification methodology

Flush channels generalize more conventional asynchronous message passing protocols. A distributed system that uses flush channels allows a programmer the flexibility of specifying the delivery order of each message in relation to other messages transmitted on the channel. An implementation technique that follows directly from a verification methodology for flush channels is presented. A relatively formal argument in support of the technique is included.<<ETX>>

Proof rules for flush channels

Flush channels generalize conventional asynchronous communication constructs such as virtual circuits and datagrams. They permit the programmer to specify receipt-order restrictions on a message-by-message basis, providing an opportunity for more concurrency in a distributed program. A Hoare-style partial correctness verification methodology for distributed systems which use flush channel communication is developed, and it is shown that it it possible to reason about such systems in a relatively natural way. >

A secure networked laboratory for kernel programming

Recently, several flavours of UNIX have appeared which run on inexpensive personal computers. Further, the source code for these operating systems is freely available. This makes offering courses that include realistic kernel programming feasible in an academic environment. However, root access is required in order to modify a systems kernel. This poses a potential security threat both to other systems on the network and to other users of a single machine. This paper presents a lab design which securely integrates machines with untrusted users acting as root into a secured network, and which securely allows multiple users root access to the same machine.

A correct and unrestrictive implementation of general semaphores

1 I n t r o d u c t i o n Hemmendinger has recently presented a functionally correct implementation of general semaphores using only binary semaphores for concurrency control [2]. That work was motivated by a paper by Kotulski [3] in which the traditional textbook solution to the problem was shown to be incorrect. Hemmendingers solution is presented in Figure 1. t y p e semaphore-r e c o r d mutex = 1, delay = 0: b i n a r y _ s e m a p h o r e ; The important point to note in this code is that if one attempts to V a general semaphore whose value is less than or equal to zero, then the process calling V will not release mutual exclusion (i.e., it will not execute VB(s.mutex)) before its return from V. The retention of mutual exclusion is the mechanism by which the error in the traditional construction, as demonstrated by Kotulski, is eliminated. However, the retention of mutual exclusion results in general semaphores whose use is restrictive. Certain behaviors of a system which utilizes such semaphores would be proscribed by Hemmindingers implementation. More specifically, if the value of s.count is negative (and, consequently, there are a number of processes suspended on s.d~lay), this implementation will not permit a sequence of V operations to be executed. There will be a lockstep sequence of a V followed by the completion of a suspended P until s.count becomes non-negative. Such restricted behavior could possibly have substantial performance penalties in certain system contexts. A criticism of

Using tracing to direct our reasoning about distributed programs

Two principles are proposed for proving and tracing distributed programs: it is necessary to assert in proofs only what can be readily traced, and trace just what can be asserted in the proofs. A proof system and tracing strategy are described for CSP programs based on these principles, using vector time and control variables, not auxiliary variables, to represent control state, and stressing local rather than global reasoning.<<ETX>>

Bounding sequence numbers in distributed systems: a general approach

The authors present a general methodology for bounding the range of sequence numbers utilized in a distributed program to order events. This methodology requires explicit knowledge of bounds on the rate at which processes may increment sequence numbers and the time required to transmit a message. It may also require the inclusion of additional synchronization in a distributed application which utilizes the bounded sequence numbers. The methodology is demonstrated in three contexts. It is shown how a scheme for bounding sequence numbers on requests for network mutual exclusion is consistent with the methodology. Sequence numbers are bound in a network mutual exclusion protocol. The methodology is utilized to bound the size of sequence numbers used in successive fault-tolerant broadcasts among a group of fail-stop processors. In all three cases, with totally different message-passing patterns and means of incrementing sequence numbers, consistent application of the methodology is stressed.<<ETX>>

Distributed deadlock detection and resolution based on hardware clocks

Inexpensive but accurate hardware clocks are now commonplace on many systems. A clock synchronization protocol can keep the collection of clocks for a group of networked systems roughly synchronized without the expenditure of a great deal of processor time or network bandwidth. As long as the bounded skew between clocks is taken into account, rough real time can provide an intuitive and valuable mechanism for providing a notion of order in a distributed system. This paper presents a straightforward token-based protocol for the detection of distributed deadlock under the single resource model. It uses clock values as token time stamps to ensure that exactly one process in a deadlock cycle, the process that completed the cycle, detects the deadlock and aborts, breaking the deadlock. The clock-valued time stamps also ensure that no false deadlocks are detected, without additional protocol to eliminate obsolete tokens. Arguments for the correctness of the protocol are developed.