Vikram Kaul

Declarative Infrastructure Configuration Synthesis and Debugging

There is a large conceptual gap between end-to-end infrastructure requirements and detailed component configuration implementing those requirements. Today, this gap is manually bridged so large numbers of configuration errors are made. Their adverse effects on infrastructure security, availability, and cost of ownership are well documented. This paper presents ConfigAssure to help automatically bridge the above gap. It proposes solutions to four fundamental problems: specification, configuration synthesis, configuration error diagnosis, and configuration error repair. Central to ConfigAssure is a Requirement Solver. It takes as input a configuration database containing variables, and a requirement as a first-order logic constraint in finite domains. The Solver tries to compute as output, values for variables that make the requirement true of the database when instantiated with these values. If unable to do so, it computes a proof of unsolvability. The Requirement Solver is used in different ways to solve the above problems. The Requirement Solver is implemented with Kodkod, a SAT-based model finder for first-order logic. While any requirement can be directly encoded in Kodkod, parts of it can often be solved much more efficiently by non model-finding methods using information available in the configuration database. Solving these parts and simplifying can yield a reduced constraint that truly requires the power of model-finding. To implement this plan, a quantifier-free form, QFF, is defined. A QFF is a Boolean combination of simple arithmetic constraints on integers. A requirement is specified by defining a partial evaluator that transforms it into an equivalent QFF. This QFF is efficiently solved by Kodkod. The partial evaluator is implemented in Prolog. ConfigAssure is shown to be natural and scalable in the context of a realistic, secure and fault-tolerant datacenter.

Building autonomic systems via configuration

Large classes of autonomic (self-managing, self-healing) systems can be created by logically integrating simpler autonomic systems. The configuration method is widely used for such integration. However, there are few formalized tools in support of this method for specification, compilation, diagnosis, reasoning, and distributed provisioning. As a result, the practice of this method is very costly and can lead to security failures. This paper presents a technique called Service Grammar for building these tools based on a novel analysis of protocols and distributed algorithms in a domain of interest. The technique is illustrated in the context of a realistic adaptive virtual private network. We show how lower-layer adaptive protocols can be composed to create adaptive behavior at a higher layer.

On the adaptation of commercial smartphones to tactical environments

Commercial smartphones are being actively looked at as solving the communication needs of the future warfighter. Several ongoing efforts are driving the research and development of custom hardware, architectures, middleware and software to bring smartphones into the tactical realm. In this work2, we first present a deployment architecture and use cases for commercial smartphones to be used in a heterogeneous environment that includes expeditionary cellular, ad-hoc wireless and indigenous cellular networks as well as smartphone connecting to traditional military radios over other native interfaces. We then introduce the Heterogeneous Tactical Gateway (HTG), an appliqué based platform that attaches to the expeditionary cellular system in a tactical vehicle and offers a fully configurable set of capabilities such as, tunneling, multicast, NAT(Network Address Translation), mobility and security management. The HTG is an IP-based solution completely independent of underlying radio access technology (e.g., EV-DO, HSPA, LTE and WiMAX) and vendor specific hardware box. HTG functional components can be incorporated when standards interfaces emerge that attempt to collate tactical and commercial requirements for communications and security. We also discuss some experiments and results that have been performed in the S&TCD lab at CERDEC, Ft Monmouth, NJ.

An integrated soft handoff approach to IP fast reroute in wireless mobile networks

This paper presents an integrated approach to IP fast reroute (IPFRR) of both unicast and multicast paths in wireless mobile networks. A distinct feature of the proposed approach is that, instead of modifying existing routing protocols, it employs a soft handoff technique, i.e., temporarily installs pre-computed Loop Free Alternative Paths (LFAPs) until the co-existing routing protocol converges to new routes. The proposed approach builds on our previously proposed IPFRR technology and uses the concept of pre-computed LFAPs not only for local but also for remote link failures within a certain neighborhood to achieve full alternative path coverage for a single link failure. This papers contributions include: i) bandwidth efficient fast failure detection by integrating two novel mechanisms, namely probing and link quality prediction, ii) a novel method for calculating LFAPs, iii) a framework for switching seamlessly between LFAPs and OSPF paths, iv) a multicast fast reroute mechanism, and v) implementation in eXtensible Open Router Platform (XORP). We also present a generic framework for handling multiple simultaneous failures in the integrated IPFRR. The performance evaluation has been performed in both indoor and outdoor environments with real 802.11 radio links. The results confirm that our IPFRR technology consistently provides significant convergence time improvement during a single link failure event.

The dynamic community of interest and its realization in ZODIAC

The ZODIAC project has been exploring a security first approach to networking based on a new idea, the dynamic community of interest, based on groups of users with a demonstrable need to know. ZODIAC uses the most challenging network setting (the mobile ad hoc network) as a target, since each node must incorporate functions of both hosts and routers. The realization of the DCoI is a work in progress, but initial implementation results have shown that DCoI concepts can be translated into working systems. The current system applies virtual machine containers, extensive use of cryptography and digital signatures, dispersity routing, DHT-based naming, and explicit rate control among other advanced techniques. Putting security to the forefront in the design has led to interesting consequences for naming, authorization, and connection setup. In particular, it has demanded a hierarchical structure for DCoIs that may initially appear somewhat alien to Internet users. Nonetheless, our implementation has illustrated that a highly available network that provides confidentiality and integrity can be constructed and made usable.

Intelligent application persistence in tactical wireless networks

Mobile tactical MANETs are subject to periods of intermittent connectivity and transient events of significant packet loss. Because of such disruptions, protocols and technologies have been proposed that are disruption and delay tolerant. One class of such systems works by storing messages/packets in the network. If connectivity to neighbors is lost, missing messages may be delivered when connectivity to neighbors is restored. This delay tolerant networking (DTN) technology aims to reliably deliver all the data that a source directs towards a receiver node. We suggest that in some cases it is of little utility and may even be counter-productive to persist and deliver all packets lost during a disruption episode. For example, in situational awareness applications, retransmitting many seconds or minutes of lost GPS tracks is not appropriate. Instead a snapshot of the current position of all tracked entities is preferable. Similarly in a multimedia stream or VOIP call, just the key missing information should be replayed. Not only does full retransmission of all missing packets introduce delays during retransmission, but also the bandwidth consumed during retransmission is wasted. Note that each application may have different semantics. Therefore determining what data is appropriate to deliver for a given application in order to recover from a temporary disconnection requires knowledge of the application semantics. In previous work, we proposed Heterogeneous Intelligent Filtering (HIF), a technology that intelligently filters and transforms data to match network capacity and end-user capability. In HIF, extraneous information not needed by the end-user is filtered by HIF agents. In this work2, we show how the HIF concept can be extended to the data and information persisted during disruptions. The information stored for later retransmission to previously disconnected receivers may consist of application state snapshots, summaries or transcripts of the missing data, or just those portions of a media stream judged to be relevant to the user at a given point in time. We describe our work on application aware persistence for real-time multimedia and tactical situational awareness applications. The middleware infrastructure of the HIF systems reported on in previous work is extended to support application aware persistence. We analyze the performance benefit of application persistence on a tactical situational awareness scenario. Application persistence is particularly useful when the end-device may be limited in its processing power and ability to render data, since it reduces the demands on the client application. Accordingly, we also illustrate the usefulness of our application aware persistence middleware in supporting multimedia and situational awareness applications implemented on handheld Android devices.

Intelligent content transformation in tactical wireless networks

Mobile tactical MANETs are interconnected via a quasi-static backbone network (QSN) that is relatively stationary and has substantial radio bandwidth capability. Because of high mobility and terrain sensitivity, the bandwidth available to mobile nodes within the MANET may vary significantly over time. During the periods where the bandwidth available is reduced, MANET nodes may be unable to handle the information load sourced from or distributed via the QSN. Furthermore, end-user devices and end-users themselves may have limited capability to receive/process data. Thus, the data delivered to tactical MANETs needs to be carefully managed. In previous work, we proposed Heterogeneous Intelligent Filtering (HIF) in multi-domain heterogeneous networks, for intelligent active filtering and transformation of the data to match network and end-user capacity. In this work2, we report on extending HIF to militarily important applications such as XMPP-based chat, SOA Web-services, and VOIP applications. We also provide experimental results based on outdoor testing of the filtering and content adaptation capabilities of HIF agents deployed in an HMS radio inter-network at Ft. Monmouth, NJ.

Robust PIM-SM Multicasting Using Anycast RP in Wireless Ad Hoc Networks

Due to its bandwidth efficiency, multicast makes a group-centric communication more viable in wireless ad hoc networks with limited radio resources. PIM-SM, a de facto standard multicast protocol known for its high scalability, is a good fit for a large-scale ad hoc network. However, it does not provide a robust multicast communication under RP outage and host mobility. In this paper, we propose a robust way of configuring PIM-SM using Anycast RP in wireless ad hoc networks. We analyze the impact of cardinality and locations of anycast RPs on the network performance under node mobility. Based on these observations, we find metrics for near-optimal cardinality of anycast RPs and propose a novel RP selection scheme. The proposed scheme is proven to make PIM-SM robust against mobility while satisfying QoS requirements and maintaining the scalability of PIM-SM.

Heteregeneous Intelligent Filtering in tactical wireless mobile networks

In this paper4, we propose a novel approach, which is termed Heterogeneous Intelligent Filtering (HIF), for intelligent control and application data filtering in multi-domain heterogeneous networks. HIF creates intelligent gateways to rapidly and autonomously adapt the flow of information content to the changing mission needs and network characteristics. HIF employs a MANET Management Protocol (termed MMP) which enables a novel light-weight publish/subscribe mechanism. Interoperability is provided with upper echelon networks running legacy directory and session announcement protocols. MANET users can discover multicast information sourced in the backbone network and subscribe to only subset of the information that they need. HIF enables the MANET nodes to avoid being swamped by too much data - extraneous information not needed by the end-user is filtered by the HIF agents. Adaptation is triggered by QoS messages derived from ongoing application performance and network monitoring. We have implemented HIF in a laboratory testbed using the MANE emulation system, and successfully demonstrated its publish/subscribe and filtering capabilities for real-time multimedia and tactical situational awareness applications. The experiments confirmed our conjecture that if adaptive and intelligent content filtering is performed, the end-user performance (and packet loss and latency) becomes significantly and consistently better during the periods when MANET nodes are subjected to overload conditions.

Self-correcting Adaptive Tracking System

The benefits of Global Positioning System (GPS) are recognized in numerous military as well as civilian applications. In many situations, however, GPS signals are simply not available or, at best, intermittently observable. This paper describes a novel location tracking system, called self-correcting adaptive tracking system (SATS), which focuses on solving group location problem when GPS is not available. In our location tracking system, we use a tracking mechanism that allows locating group members based on their pair wise distance information. A key innovation of SATS is that we use an adaptive search algorithm to find the new position estimate based on constraints given by the ranged data. In addition, our location tracking system is capable of extracting directional information normally unavailable in ranging system, which allows us to adaptively stabilize the orientation of the group. The SATS methodology has been prototyped and tested as part of an Office of Navy Research (ONR) program.