Search

With the application of wireless sensor network (WSN) in healthcare field, online sharing of medical data has attracted more and more attention. However, wearable sensor nodes in WSN are limited in energy, storage space and data processing capacity, which largely restricts their deployment in resource demand application scenarios. Fortunately, cloud storage services can enrich the capabilities of wearable sensors and provide an effective method for people to share data within a group. However, as medical data directly relates to patients' health and privacy information, ensuring the integrity and privacy of medical records stored in cloud servers becomes a key issue to be urgently solved. Many public data auditing schemes have been put forward to address the above issues. Unfortunately, most of them have security vulnerabilities or poor functionality and performance. In this paper, we come up with a secure and efficient certificateless public auditing scheme for cloud-assisted medical WSNs, which not only supports dynamic data sharing and privacy protection, but also achieves efficient group user revocation. Security analysis and performance evaluation demonstrate that our scheme significantly reduce the total computation cost while achieving a higher security level. Compared with other related schemes, our new proposal is more suitable for group user data sharing in cloud-assisted medical WSNs.

With the proliferation of versatile mobile applications, offloading compute-intensive tasks to the MEC/Cloud becomes a dramatic technique due to the limited resources and high user experience requirements at mobile devices. However, most existing works design their task offloading schemes without considering the dependence of tasks and the orchestration of the MEC and Cloud, and thus may limit the system performance. In this paper, we propose a dependent task offloading framework for multiple mobile applications, named COFE, where mobile devices can offload their compute-intensive tasks with dependent constraints to the MEC-Cloud system. It can assign the offloaded tasks to the MEC and Cloud adaptively to improve the user experience. Based on COFE, we formulate the task offloading problem as an average makespan minimization problem, which is proved to be NP-hard. Then, we propose a heuristic ranking-based algorithm to assign the offloaded tasks according to their bottom levels. Theoretical analysis proves the stability of the system under the proposed algorithm and extensive simulations validate that the proposed algorithm can significantly reduce the average makespan and deadline violation probabilities of offloaded applications.

The cloud-assisted mobile edge computing system is a critical architecture to process computation-intensive and delay-sensitive mobile applications in close proximity to mobile users with high resource efficiency. Due to the heterogenous dynamics of task arrivals at edge nodes and the distributed nature of the system, the workloads of edge nodes are prone to be unbalanced, which can cause high task response time and resource cost. This paper solves the dynamic task scheduling problem in cloud-assisted mobile edge computing (including both peer task scheduling among edge nodes and cross-layer task scheduling from edge nodes to the cloud), aiming at minimizing average task response time within resource budget limit. To overcome the challenges of task arrival dynamics, edge node heterogeneity, and computation-communication delay tradeoff, we propose a Water-filling Based Dynamic Task Scheduling (WiDaS) algorithm. WiDaS dynamically tunes the usage of cloud resources based on the Lyapunov optimization method and efficiently schedules mobile tasks among edge nodes (and the cloud) by exploiting the idea of water filling. Extensive simulations are conducted to evaluate WiDaS under a trace-driven traffic pattern and two mathematic traffic patterns. The results demonstrate that WiDaS shows two-fold benefits of efficiency and effectiveness.

The security of our data stores is underestimated in current practice, which resulted in many large-scale data breaches. To change the status quo, this paper presents the design of ShieldDB, an encrypted document database. ShieldDB adapts the searchable encryption technique to preserve the search functionality over encrypted documents without having much impact on its scalability. However, merely realising such a theoretical primitive suffers from real-world threats, where a knowledgeable adversary can exploit the leakage (aka access pattern to the database) to break the claimed protection on data confidentiality. To address this challenge in practical deployment, ShieldDB is designed with tailored padding countermeasures. Unlike prior works, we target a more realistic adversarial model, where the database gets updated continuously, and the adversary can monitor it at an (or multiple) arbitrary time interval(s). ShieldDB's padding strategies ensure that the access pattern to the database is obfuscated all the time. Additionally, ShieldDB provides other advanced features, including forward privacy, re-encryption, and flushing, to further improve its security and efficiency. We present a full-fledged implementation of ShieldDB and conduct intensive evaluations on Azure Cloud., Comment: Accepted version of our work published in IEEE Transactions on Knowledge and Data Engineering (TKDE, 2021)

The appearance of Mobile Edge Computing (MEC) successfully solves the bottlenecks of traditional Cloud based networks. Since mobile edges, e.g. base stations, and mobile devices have certain data processing capabilities, it is not necessary to offload all the tasks to the cloud for handling. Therefore, it is quite important to decide the optimal task assignment in MEC systems, and a series of algorithms have been proposed. However, the existing algorithms ignored the data distribution during task assignment, so that their applied ranges are quite limit. Considering the data sharing is quite important in a MEC system, this paper studies task assignment algorithms in Data Shared Mobile Edge Computing Systems in detail. Specifically, three algorithms are proposed to deal with the unordered and ordered holistic tasks respectively. Meanwhile, the situation that the tasks are divisible is also considered, and two algorithms for rearranging the divisible tasks are proposed for different optimization goals. The hardness of the problem, the correctness, complexities, and ratio bounds of the proposed algorithms are analyzed theoretically. Finally, extensive experimental results are carried out. Both theoretical analysis and experiment results show that all the proposed algorithms have high performance in terms of latency, satisfied rate, and energy consumption.

More and more IoT data is being traded online in cloud-based data marketplaces due to the fast-growing market demand. Within the current data selling mechanisms, data consumers have difficulties in making purchasing decisions due to uncertain data quality and inflexible pricing interface. To resolve them, potential solutions could be to launch data demonstrations and release free sampling data to reduce the uncertainty about data quality, and to charge based on the volume of data for enabling flexible pricing. However, their economic benefits are still not clear. In this paper, we design the optimal data selling mechanisms for IoT data exchange, and derive the following results. First, whether to deploy data demonstrations and how much free sampling data to release depend on the extent of data consumers inaccuracy perceptions for data quality. We found that data vendors have no incentive to conduct these strategies if data consumers extremely overestimate data quality. Second, although flexible data pricing mechanisms provide convenience for real-time and streaming IoT data exchange, it brings less economic benefits to data vendors compared with fixed pricing schemes. We evaluate the optimal selling mechanisms on a real-world Taxi GPS dataset. Evaluation results verify the insights derived from our theoretical analysis.

Nowadays, most telecommunication services adhere to the Service Function Chain (SFC) paradigm, where network functions are implemented via software. In particular, container virtualization is becoming a popular approach to deploy network functions and to enable resource slicing among several tenants. The resulting infrastructure is a complex system composed by a huge amount of containers implementing different SFC functionalities, along with different tenants sharing the same chain. The complexity of such a scenario lead us to evaluate two critical metrics: the steady-state availability (the probability that a system is functioning in long runs) and the latency (the time between a service request and the pertinent response). Consequently, we propose a latency-driven availability assessment for multi-tenant service chains implemented via Containerized Network Functions (CNFs). We adopt a multi-state system to model single CNFs and the queueing formalism to characterize the service latency. To efficiently compute the availability, we develop a modified version of the Multidimensional Universal Generating Function (MUGF) technique. Finally, we solve an optimization problem to minimize the SFC cost under an availability constraint. As a relevant example of SFC, we consider a containerized version of IP Multimedia Subsystem, whose parameters have been estimated through fault injection techniques and load tests.

For cloud network performance profiling, network tomography based on end-to-end measurement is often used in deducing the network performance for its efficiency. However, most tomography problems are under-constrained, which require additional assumptions or probing monitors planted among network switches, which are often unavailable in software-defined networking (SDN) environment. On the other hand, SDN based flow mirroring could provide accurate flow information, but the cost of both gathering and analysing the packet traces is tremendous that it is impossible to cover the whole network. We propose ScoutFlow, a method combining SDN flow measurement and end-to-end performance tomography, to achieve accurate performance profiling for cloud network while keeping low monitoring overhead. We evaluate ScoutFlow in our campus data center cloud, the experiment shows good scalability and accuracy.

Machine Learning (ML) algorithms can effectively perform analytics and inferences for building smart applications, such as early detection of diseases in the Industrial Internet of Things (IIoT) and smart healthcare systems. The main components of ML, including training and testing phases, can be decomposed into microservices to improve service quality, along with fast implementation and integration with the edge and cloud services. However, the execution of ML in an edge-cloud environment introduces privacy risks to data owners (e.g., patients). In this paper, we present a privacy-preserving machine learning (ML) framework by leveraging microservice technology for safeguarding healthcare IIoT systems. More specifically, we develop a microservice-based distributed privacy-preserving technique using Differential Privacy (DP) and Radial Basis Function Network (RBFN) to balance between privacy protection and model performance in edge networks. We conduct extensive experiments to evaluate the performance of the proposed technique. The results revealed that DP has a significant influence on the model’s performance and achieves more than 90% accuracy with an epsilon value over 0.4, enhancing data protection and analytics through the implementation of microservices.

With the rapid development of Internet of Things (IoT) and next-generation communication technologies, resource-constrained mobile devices fail to meet the demand of resource-hungry and compute-intensive applications. To cope with this challenge, with the assistance of Mobile Edge Computing (MEC), offloading complex tasks from mobile devices to edge cloud servers or central cloud servers can reduce the computational burden of devices and improve the efficiency of task processing. However, it is difficult to obtain optimal offloading decisions by conventional heuristic optimization methods, because the decision-making problem is usually NP-hard. In addition, there are shortcomings in using intelligent decision-making methods, e.g., lack of training samples and poor ability of migration under different MEC environments. To this end, we propose a novel offloading algorithm named MR-DRO, consisting of a Meta-Reinforcement Learning (meta-RL) model, which improves the migration ability of the whole model, and a Deep Reinforcement Learning (DRL) model, which combines multiple parallel Deep Neural Networks (DNNs) to learn from historical task offloading scenarios. Simulation results demonstrate that our approach can effectively and efficiently generate near-optimal offloading decisions in IoT environments with edge and cloud collaboration, which further improves the computational performance and has strong portability when making offloading decisions.

Recent advancements of Industrial IoT (IIoT) have revolutionized modern urbanization and smart cities. While IIoT data contains rich events and objects of interest, processing a massive amount of IIoT data and making predictions in real-time is challenging. Recent advancements in AI allow processing such a massive amount of IIoT data and generating insights for further decision-making processes. In this paper, we propose several key aspects of AI-enabled IIoT data for smart city monitoring. Firstly, we have combined a human-intelligence-enabled crowdsourcing application with that of an AI-enabled IIoT framework to capture events and objects from IIoT data in real-time. Secondly, we have combined multiple AI algorithms that can run on distributed edge and cloud nodes to automatically categorize the captured events and objects and generate analytics, reports, and alerts from the IIoT data in real-time. The results can be utilized in two scenarios. In the first scenario, the smart city authority can authenticate the AI-processed events and assign these events to the appropriate authority for managing the events. In the second scenario, the AI algorithms are allowed to interact with humans or IIoT for further processes. Finally, we will present the implementation details of the scenarios mentioned above and the test results. The test results show that the framework has the potential to be deployed within a smart city.

A Smart Factory exploits information and communication technologies (ICT) to improve the production process and the working environment, usually addressing safety concerns. To this concern, factory-grade fire protection systems are governed by several procedures and standards whose application often becomes definitely challenging when the factory premises are dispersed across multiple administrative domains. In such contexts, the Smart Factory approach can prove very effective in the management and coordination of the factory-level fire protection system. However, a catastrophic event may compromise the ICT infrastructure, affecting communication among factory domains and therefore its smart services. A strategy to cope with the latter may be the introduction of mechanisms to handle data analysis on-site for a prompt response while enabling seamless data distribution and processing among neighbouring (federated) ICT infrastructures and emergency operators. In this work, a novel software-defined approach for the adaptive management of a Smart Factory infrastructure is proposed, centered around business logic rewiring and reconfiguration at run-time across different factory domains. Thereby, even in the case of catastrophic (e.g., potentially disruptive) events, working devices of the emergency system can go on with their operations, including transferring data to rescuers and others emergency control systems. To demonstrate the effectiveness of the proposed Software Defined Factory approach, a Federated Fire Protection System operating in an industrial setting is implemented as a case study, able to promptly react and adapt to infrastructure-critical fires and their consequences by leveraging all information and computing facilities pooled over Cloud/Fog/Edge devices spanning the premises.

Agriculture is an important sector that plays an essential role in the economic development of a country. Each year farmers face numerous challenges in producing good quality crops. One of the major reasons behind the failure of the harvest is the use of unscientific agricultural practices. Moreover, every year enormous crop loss is encountered either by pests, specific diseases, or natural disasters. It raises a strong concern to employ sustainable advanced technologies to address agriculture-related issues. In this paper, a sustainable real-time crop disease detection and prevention system, called CROPCARE is proposed. The system integrates mobile vision, Internet of Things (IoT), and Google Cloud services for sustainable growth of crops. The primary function of the proposed intelligent system is to detect crop diseases through the CROPCARE -mobile application. It uses Super-Resolution Convolution Network (SRCNN) and the pretrained model MobileNet-V2 to generate a decision model trained over various diseases. To maintain sustainability, the mobile app is integrated with IoT sensors and Google Cloud services. The proposed system also provides recommendations that help farmers know about current soil conditions, weather conditions, disease prevention methods, etc. It supports both Hindi and English dictionaries for the convenience of the farmers. The proposed approach is validated by using the PlantVillage dataset. The obtained results confirm the performance strength of the proposed system.

Edge computing (EC) offers cloud-like services at the edge of mobile networks to satisfy the delay-sensitive and rapid computation applications in meeting the demands of rapidly increasing mobile devices and other IoTs. EC is known to be constrained with limited resources that its efficacy greatly depends on an effective and efficient resource allocation to provide optimal resources utilization. Focusing on the fact, this paper presents an adaptive resource allocation mechanism, abbreviated as A-PBRA, for effective resources utilization in the EC paradigm. To realize optimal utilization, the available resources are allocated dynamically (adaptability) by considering the nature of the incoming requests. The proposed scheme shall adapt to the resource demands and priorities of the incoming requests. After identifying the received request which can be either priority-based or normal request, each of them is processed with three possibilities. The available resources are thus allocated as per the priorities of the incoming requests to satisfy the constraints accordingly. The proposed mechanism is adaptable to a maximum number of incoming requests along with optimizing the utilization of limited resources at the edge node. Extensive simulations were performed through ifogsim to evaluate the performance of the proposed method. Critical comparisons were made against closely related algorithms and techniques i.e., the NBIHA and the CORA-GT. The simulation results from the proposed scheme optimistically showing that it performed better in terms of resources utilization, average response time, task execution time, and energy consumption.

Refereed/Peer-reviewed This paper considers the design of heterogeneous multi-cloud systems for big data storage and computing in the presence of cloud collusion and failures. A fundamental concept of such a system is the secrecy capacity, which represents the maximum amount of information that can be stored for each unit of storage space under the requirements of secure distributed computing. A capacity-achieving code is designed for matrix multiplication, a computing subroutine widely used in machine learning applications. The code allows fast parallel decoding and unequal data allocation in the clouds. Such a flexibility leads naturally to the idea of optimizing data allocation to minimize the computing time. Given any feasible storage budget, the optimal solution is derived, characterizing explicitly the fundamental tradeoff between storage and computing. Furthermore, it is shown via majorization theory that the whole tradeoff curve improves if the cloud computing rates are more even. Experiments on Amazon EC2 clusters are conducted, corroborating our theoretical observations and the negligibility of decoding overhead

Edge computing has been recently introduced as a way to bring computational capabilities closer to end users of modern network-based services, in order to support existent and future delay-sensitive applications by effectively addressing the high propagation delay issue that affects cloud computing. However, the problem of efficiently and fairly manage the system resources presents particular challenges due to the limited capacity of both edge nodes and wireless access networks, as well as the heterogeneity of resources and services' requirements. To this end, we propose a techno-economic market where service providers act as buyers, securing both radio and computing resources for the execution of their associated end users' jobs, while being constrained by a budget limit. We design an allocation mechanism that employs convex programming in order to find the unique market equilibrium point that maximizes fairness, while making sure that all buyers receive their preferred resource bundle. Additionally, we derive theoretical properties that confirm how the market equilibrium approach strikes a balance between fairness and efficiency. We also propose alternative allocation mechanisms and give a comparison with the market-based mechanism. Finally, we conduct simulations in order to numerically analyze and compare the performance of the mechanisms and confirm the theoretical properties of the market model., Comment: Corrected typos and figure orientation. in IEEE Transactions on Mobile Computing

This publication offers a comprehensive survey on the topic of Low-Power Wide Area Networks (LPWANs). We discuss the scope of LPWAN connectivity and present numerous well-established technologies that can offer such a service. From this presentation, LoRa/LoRaWAN systems emerge as one of the dominant solutions, and hence we offer details about end-to-end LoRa/LoRaWAN-enabled networking. As an area being in its infancy, LPWANs in general and LoRa/LoRaWAN in specific undergo extensive research. We shed light in key contributions, whereas we also provide our findings regarding the main research focus and needs. Simulation studies appear to be a popular choice among researchers, whereas real system implementations are constantly emerging thanks to low deployment and operational cost. For the former, we offer a comparative overview of existing simulators, whereas for the latter we discuss key considerations about the server-side part of a deployed system, which is usually supported by cloud infrastructure. Finally, LPWANs are systems that experience intense data generation, and thus we deliver a presentation of data-related operations which take place in such systems. This presentation revealed a major vertical market that is expected to be served by LPWANs: the Industiral IoT; which embodies concepts like Asset Administration Shell and Digital Twins.

The 5G network presents a new horizon with tremendous opportunities for future generation wireless networks. Mobile edge computing (MEC), non-orthogonal multiple access (NOMA), and network slicing (NS) are some of the key enablers for 5G. MEC reduces the latency to a great extent for a wireless network, while NOMA gives access to more users with resource constraints. NS provides users with a better quality of service and network operators with more flexibility. In this work, we propose an NS technique enabled with NOMA for a MEC network. The proposed NS technique improves service latency for MEC users and reduces the unnecessary allocation of radio resources in NOMA. The saved resources can be leveraged to accommodate more users, thus increasing the spectral efficiency of the network. We consider different types of services based on the task completion time of users in this work. The primary focus is to optimize the total energy consumption for wireless uplink transmission for the NOMA-enabled sliced MEC network. We also propose a heuristic algorithm as an alternative to reduce the time and computational complexities of the optimization algorithm and simulate the results extensively to show the effectiveness of our proposed algorithm.

Policy-based chameleon hash (PCH) is one of the techniques used for rewriting transaction-level data stored in blockchains. This technique integrates the access policy of the attribute-based encryption (ABE) in the transactions and only allows users with attributes set satisfying the access policy to modify the transactions. However, some operations in the PCH-based rewritable blockchain solution require high computational cost which may impact the performance of user systems, especially on resource-constrained devices. To solve this problem, we propose an online/offline rewritable blockchain with auditable outsourced computation (OO-RB-AOC) scheme. We utilize the ring signature to ensure the credibility of multiple attribute authorities, and adopt the online/offline technique for generating the hash of the rewritable transaction. In addition, expensive computations (e.g., pairings) required for rewriting the transactions can be outsourced to the clouds. The users can rest assured that the computations from the clouds are correct with the audit mechanism of the proposed scheme. On the other hand, the proposed scheme offers a desirable feature for commercial application where the clouds can limit the number of outsourced requests according to the subscription of the users. We also prove the security of the proposed OO-RB-AOC scheme. Finally, we present a theoretical comparison and experimental analysis of the proposed scheme.

Unexpectedly, the rise of serverless computing has also collaterally started the ‘`democratization’' of massive-scale data parallelism. This new trend heralded by PyWren pursues to enable untrained users to execute single-machine code in the cloud at massive scale through platforms like AWS Lambda. Driven by this vision, this article presents Lithops, which carries forward the pioneering work of PyWren to better exploit the innate parallelism of la MapReduce tasks atop several Functions-as-a-Service platforms. Instead of waiting for a cluster to be up and running in the cloud, makes easy the task of spawning hundreds and thousands of cloud functions to execute a large job in a few seconds from start. With Lithops, for instance, users can painlessly perform exploratory data analysis from within a Jupyter notebook, while it is the Lithops's engine which takes care of launching the parallel cloud functions, loading dependencies, automatically partitioning the data, etc. In this article, we describe the design and innovative features of Lithops and evaluate it using several representative applications, including sentiment analysis, Monte Carlo simulations, and hyperparameter tuning. These applications manifest the Lithops ability to scale single-machine code computations to thousands of cores. And very importantly, without the need of booting a cold cluster or keeping a warm cluster for occasional tasks.

The proliferation of Internet of Things (IoT) data and innovative mobile services has promoted an increasing need for low-latency access to resources such as data and computing services. Mobile edge computing has become an effective computing paradigm to meet the requirement for low-latency access by placing resources and dispatching tasks at the edge clouds near mobile users. The key challenge of such solution is how to efficiently place resources and dispatch tasks in the edge clouds to meet the QoS of mobile users or maximize the platform's utility. In this paper, we study the joint optimization problem of resource placement and task dispatching in mobile edge clouds across multiple timescales under the dynamic status of edge servers. We first propose a two-stage iterative algorithm to solve the joint optimization problem in different timescales, which can handle the varieties among the dynamic of edge resources and/or tasks. We then propose a reinforcement learning (RL) based algorithm which leverages the learning capability of Deep Deterministic Policy Gradient (DDPG) technique to tackle the network variation and dynamic as well. The results from our trace-driven simulations demonstrate that both proposed approaches can effectively place resources and dispatching tasks across two timescales to maximize the total utility of all scheduled tasks.

The increasing popularity of remote Cloud File Sharing (CFS) has become a major concern for privacy breach of sensitive data. Aiming at this concern, we present a new resource sharing framework by integrating enterprise-side Attribute-Based Access Control/eXtensible Access Control Markup Language (ABAC/XACML) model, client-side Ciphertext-Policy Attribute-Based Encryption (CP-ABE) scheme, and cloud-side CFS service. The framework workflow is provided to support the encrypted-file writing and reading algorithms in accordance with ABAC/XACML-based access policy and attribute credentials. However, an actual problem of realizing this framework is that policy matrix, derived from access policy, seriously affects the performance of existing CP-ABE from Lattice (CP-ABE-L) schemes. To end it, we present an optimal generation algorithm of Small Policy Matrix (SPM), which only consists of small elements, and generates an all-one reconstruction vector. Based on SPM, the improved CP-ABE-L scheme is proposed to reduce the cumulative errors to the minimum. Furthermore, we give the optimal estimation of system parameters to implement a valid Error Proportion Allocation (EPA). Our experiments indicate that our scheme has short size of parameters and enjoys efficient computation and storage overloads. Thus, our new framework with optimization methods is conducive to enhancing the security and efficiency of remote work on CFS.

As a rising star of social apps, short video apps, e.g., TikTok, have attracted a large number of mobile users by providing fresh and short video contents that highly match their watching preferences. Meanwhile, the booming growth of short video apps imposes new technical challenges on the existing computation and communication infrastructure. Traditional solutions maintain all videos on the cloud and stream them to users via contend delivery networks or the Internet. However, they incur huge network traffic and long delay that seriously affect users' watching experiences. In this paper, we propose an edge-assisted short video sharing framework to address these challenges by caching some videos highly preferred by users at edge servers that can be accessed by users via high-speed network connections. Since edge servers have limited computation and storage resources, we design an online algorithm with provable approximation ratio to decide which videos should be cached at edge servers, without the knowledge of future network quality and watching preferences changes. Furthermore, we improve the performance by jointly considering video fetching and user-edge association. Extensive simulations are conducted to evaluate the proposed algorithms under various system settings, and the results show that our proposals outperform existing schemes.

Attribute-based encryption (ABE) has been widely used to provide fine-grained access control to encrypted data in cloud computing. However, in practice, since the attributes are shared by multiple users in the ABE system, it is difficult to identify malicious users which intentionally but implicitly reveal their own ABE secret keys for some purpose. In recent years, a substantial amount of work focused on designing efficient tracing mechanisms to identify such misbehaving users on ABE. In this paper, we propose an efficient generic construction of black-box traceable ABE to identify the traitors. Our construction supports (public) adaptive black-box traceability and has short keys and short ciphertexts that are independent of the number of users. Technically, our construction relies on a generic transformation from any attribute-based inner-product functional encryption (ABIPFE) scheme to black-box traceable ABE system. Furthermore, to instantiate our generic construction from standard lattices, we propose the first lattice-based ABIPFE scheme, which is proven weakly selective secure in the standard model.

This paper presents V-Sight, a network monitoring framework for programmable virtual networks in clouds. Network virtualization based on software-defined networking (SDN-NV) in clouds makes it possible to realize programmable virtual networks; consequently, this technology offers many benefits to cloud services for tenants. However, to the best of our knowledge, network monitoring, which is a prerequisite for managing and optimizing virtual networks, has not been investigated in the context of SDN-NV systems. As the first framework for network monitoring in SDN-NV, we identify three challenges: non-isolated and inaccurate statistics, high monitoring delay, and excessive control channel consumption for gathering statistics. To address these challenges, V-Sight introduces three key mechanisms: 1) statistics virtualization for isolated statistics, 2) transmission disaggregation for reduced transmission delay, and 3) pCollector aggregation for efficient control channel consumption. The evaluation results reveal that V-Sight successfully provides accurate and isolated statistics while reducing the monitoring delay and control channel consumption in orders of magnitude. We also show that V-Sight can achieve a data plane throughput close to that of non-virtualized SDN.

Container technology plays an important role in the virtualization landscape today. A container uses its own file system consisting of a stack of layers, which are stored on the execution server's disk. Containers running on the same server share the layers they have in common, and this sharing results in valuable savings in server storage space. Many containers can run on a single server, but when their resource demands grow enough, they are distributed across a cluster of nodes/servers by orchestration systems, such as Kubernetes. In this work, we found that for the same amount of containers to run, the storage required is higher for clusters consisting of a larger number of nodes. The severity of this storage overhead depends on the scheduling policy used to select the nodes that run the containers. By comparing different storage-saving scheduling policies that differ from each other in the depth of storage knowledge they leverage to make decisions, our analysis reveals that only deep, layer-level knowledge can effectively counter the growth in storage demand as the cluster size increases. Policies with coarser-grained knowledge achieve limited benefit because they achieve performance that is nearly equal to that of a random, zero-knowledge policy.

With the development of MEC services, MEC brokers will emerge to facilitate the purchase and management of resources for individual MEC users. Both data communication and computing resources offered by MEC service providers can be purchased by pay-as-you-go (PAYG) or reserved plans. Besides data and computing plans for each type of resource, we also consider combo plans specifically designed for MEC services covering both resources. In this paper, we propose a smart online aggregated reservation (SOAR) framework for MEC brokers to minimize their cost of reserving resources for multiple users without the knowledge of future demands. In our framework, a task aggregation algorithm is designed to aggregate the users' demands in each PAYG billing cycle to improve the plan utilization, and plan reservation algorithms are proposed to decide when to reserve which plans. The performance gap (competitive ratio) between SOAR and optimal solution which knows all future demands in advance, is analyzed and derived in closed-form. The performance gap is proved to be the minimum among all deterministic online algorithms. Trace-driven simulations verify the cost advantage of our SOAR framework, which can save nearly 40% of cost for users through the brokerage service.

We propose a flexible low complexity design (FLCD) of coded distributed computing (CDC) with empirical evaluation on Amazon Elastic Compute Cloud (Amazon EC2). CDC can expedite MapReduce like computation by trading increased map computations to reduce communication load and shuffle time. A main novelty of FLCD is to utilize the design freedom in defining map and reduce functions to develop asymptotic homogeneous systems to support varying intermediate values (IV) sizes under a general MapReduce framework. Compared to existing designs with constant IV sizes, FLCD offers greater flexibility in adapting to network parameters and significantly reduces the implementation complexity by requiring fewer input files and shuffle groups. The FLCD scheme is the first proposed low-complexity CDC design that can operate on a network with an arbitrary number of nodes and computation load. We perform empirical evaluations of the FLCD by executing the TeraSort algorithm on an Amazon EC2 cluster. This is the first time that theoretical predictions of the CDC shuffle time are validated by empirical evaluations. The evaluations demonstrate a 2.0 to 4.24x speedup compared to conventional uncoded MapReduce, a 12% to 52% reduction in total time, and a wider range of operating network parameters compared to existing CDC schemes., 13 pages, 4 figures

Leveraging emerging mobile edge computing and 5G networks, researchers proposed to offload the 3D rendering of interactive applications (e.g. virtual reality and cloud gaming onto GPU-based edge servers to reduce the user experienced latency. A task offloading problem arises, that is where to offload rendering tasks such that each user will experience tolerable delay and meanwhile the cost of used servers is minimized. The multi-dimensional resource sharing feature of rendering tasks makes the problem challenging. We formulate the task offloading problem into a boolean linear programming. We propose a sharing-aware offloading algorithm which decomposes the problem into two subproblems (user assignment and server packing and solves them alternately and iteratively. We compare our algorithm with the one without resource sharing in consideration, and the simulations demonstrate that our method can effectively reduce cost as well as satisfy delay requirement.

With the massive deployment of geographically distributed data centers (DCs) and the demand surge for cloud services, their high energy consumption and carbon pollution are increasingly problematic. Therefore, mitigating the harmful effects of the carbon footprint of DCs has become a critical challenge. This paper takes the first step toward analyzing the complementary characteristics of global multi-regional renewable energy sources (RES). There is an opportunity to schedule workloads flexibly and track RES to reduce emissions. Integrating DCs and inter-DC network to form a refined emission model for the trade-off between emission cutting effects from scheduling and carbon costs of workload migration, we propose the spatio-temporal task migration mechanism to pursue low carbon in dual-dimension: This paper shifts intensive workloads to locations sufficient in RES at a coarse scale, and adjust the execution time of the workload in response to real-time RES fluctuations at a fine scale. Thus, the emission overage is shifted and offset by RES in a complementary manner; meanwhile, the acceptance of RES is enhanced. Finally, experiments with real-world data show that our method can optimally coordinate demand with RES and mitigate carbon pollution in geographically distributed DCs, and verify the performance and applicability with various-parameter scenarios.

To satisfy the requirement of data portability, current service providers (or resource servers) usually provide OAuth-based schemes for third party applications (or clients) to access user data with the users consent. To shoulder the costs of maintaining relationships with potential third party applications, a service provider may adopt delegate the task of authentication and authorization to an authorization server. However, current OAuth specification does not specify the interactions between an authorization server and a resource server. To address this limitation, this study proposes the MyDataChain framework to enhance the existing OAuth specification with blockchain technology. The proposed framework utilizes smart contracts to establish the standard interface to support the processes of authorization requesting, granting, and revocation. As blockchain technologies can ensure data integrity, the framework can use the data stored in the blockchain to resolve disputes among different parities. Moreover, as the proposed framework uses the Non-Interactive Zero-Knowledge (NIZK) scheme, the proposed framework can achieve its purpose without storing any personal identifiable or traceable data in the blockchain.

Current Internet of Things (IoT) infrastructures rely on cloud storage however, relying on a single cloud provider puts limitations on the IoT applications and Service Level Agreement (SLA) requirements. Recently, multiple decentralized storage solutions (e.g., based on blockchains) have entered the market with distinct architecture, Quality of Service (QoS) parameters and at lower price compared to the cloud storage. In this work, we introduce BAM: a neural network-based middleware designed for intelligent selection of storage technology for IoT applications. We first propose a blockchain-based data placement protocol and theoretically model a decision optimization problem, which jointly considers cloud, multi-cloud and decentralized storage technologies to select the appropriate medium to store large-scale IoT data, while ensuring data integrity, traceability, auditability and decision verifiability. We then propose a neural network-based maintenance reconfiguration, which aims to optimize the computational complexity of the middleware design along with the blockchain transaction and storage overhead by learning and predicting the applications parameters. We also propose the aggregation rate feedback functionality in our design and model it as a linear optimization problem to improve data quality and precision. Finally, we provide a reference implementation and perform extensive experiments, which demonstrate the effectiveness of the proposed design.

Many scientific communities today have community datasets that are continuously created, curated, and maintained for community use. Such datasets are often hosted and shared through cloud-based data repositories. In this work, we propose a lightweight and affordable visualization cloud service that can be deployed as a companion service of a community dataset. Our target visualization use case is parallel flow visualization, which is crucial for understanding planet-scale phenomena such as the Earth's atmosphere and ocean. As a core research topic of scientific visualization, parallel flow visualization typically uses HPC computing platforms. It is complex to implement with scalability, deploy with efficiency, and is often considered an advanced form of scientific visualization. Because of the heterogeneous nature of cloud platforms, in this work, we use a swarm-based parallel design to replace traditional HPC designs that assume homogeneity and rely upon conventional methods such as Message Passing Interface (MPI). This design enables interactive visualization of large flow fields in a way that is lightweight, efficient and easily deployable as a cloud service. We demonstrate our proposed system using NOAA's NCEP ensemble data, which captures turbulent planet-scale atmospheric flows in observed forms, as well as in forecast forms for varying time scales.

Computational resources are increasingly virtualized to enable computational tasks to be offloaded to remote facilities along the route between the source and destination. The principle that underlies traditional routing, i.e., that only networking resources need to be considered, may no longer be true in a virtualized environment. In this paper, we propose a framework for the efficient utilization of multi-resource infrastructures in which computational resources can be used via the network. Such a framework intrinsically calls for the joint consideration of networking and computational resources. In particular, we focus on unifying the controls in dynamic service chaining and multiple resource management, which are the key technologies in an integrated SDN/NFV architecture. We formulate a multi-path problem for choosing the resources to use in different services. The problem can be viewed as variational inequality using the Lagrange duality and saddle point theory. Based on this, we develop an extragradient-based algorithm that controls and splits the sending rate of each service. We prove that the algorithm converges to the optimal, minimizing the system cost while maximizing service utility. Simulations for diverse scenarios demonstrate that our algorithm achieves high QoS while reducing the system cost by jointly considering dual-resource coupling and service characteristics.

Workflow scheduling in cloud environments has become a significant topic in both commercial and industrial applications. However, it is still an extraordinarily challenge to generate effective and economical scheduling schemes under the deadline constraint especially for the large scale workflow applications. To address the issue, this paper investigates the cloud workflow scheduling problem with the aim of minimizing the whole cost of workflow execution whereas maintaining its execution time under a predetermined deadline. A novel knowledge-based adaptive discrete water wave optimization (KADWWO) algorithm is developed based on the problem-specific knowledge of cloud workflow scheduling. In the proposed KADWWO, a discrete propagation operator is designed based on the idle time knowledge of hourly-based cost model to adaptively explore the huge search space. The adaptive refraction operator is employed to avoid stagnation and expand the available resource pool. Meanwhile, the dynamic grouping based breaking operator is designed to exploit the excellent block structure knowledge of task allocation scheme and corresponding resource to intensify the local region and accelerate convergence. Extensive simulation experiments on the well-known scientific workflow demonstrate that the KADWWO approach outperforms several recent state-of-the-art algorithms.

Although multiple techniques have been proposed with the goal of minimizing the semantic gap in virtual machine introspection, most concentrate on passive observation of the internal state, while there are also a number of proposals with which active modification of the VM's internal state is made possible. However there are issues when modifications are applied, such as keeping a consistent kernel state and avoiding a crash. In this paper we propose Oxpecker, a VMI platform for transactional modification. The out-of-VM read access allows an introspector to detect malware in the guest OS (e.g., rootkit) and the transactional write access allows Oxpecker to reliably neutralize the detected threats. To begin a transaction, Oxpecker monitors VM state changes waiting for an idle moment which is free of possible race-conditions in the guest kernel memory. Thereafter, it invokes a VMI client's callback to proceed with reading/writing in its memory. Upon user request or possible exceptions, transaction is rolled back while the transaction ACID properties are maintained at all times. Oxpecker is implemented and evaluated under different real-world workloads. Additionally and as a practical example, a tool is developed, and open sourced, based on Oxpecker with which guest VM processes could be killed.

In this paper, the problem of temporal isolation among containerized software components running in shared cloud infrastructures is tackled, proposing an approach based on hierarchical real-time CPU scheduling. This allows for reserving a precise share of the available computing power for each container deployed in a multi-core server, so to provide it with a stable performance, independently from the load of other co-located containers. The proposed technique enables the use of reliable modeling techniques for end-to-end service chains that are effective in controlling the application-level performance. An implementation of the technique within the well-known OpenStack cloud orchestration software is presented, focusing on a use-case framed in the context of network function virtualization. The modified OpenStack is capable of leveraging the special real-time scheduling features made available in the underlying Linux operating system through a patch to the in-kernel process scheduler. The effectiveness of the technique is validated by gathering performance data from two applications running in a real test-bed with the mentioned modifications to OpenStack and the Linux kernel. A performance model is developed that tightly models the application behavior under a variety of conditions. Extensive experimentation shows that the proposed mechanism is successful in guaranteeing isolation of individual containerized activities on the platform.

The volume of data is increasing rapidly currently, which poses a great challenge for resource-constrained clients to process and analyze. A promising approach for solving computation-intensive tasks is to outsource them to the cloud to take advantage of the clouds powerful computing ability. However, it also brings privacy and security issues since the data uploaded to the cloud may contain sensitive and private information which should be protected. In this paper, we address this problem and focus on the privacy-preserving and secure outsourcing of large-scale nonlinear programming problems (NLPs) subject to both linear constraints and nonlinear constraints. Large-scale NLPs play an important role in the eld of data analytics but have not received enough attention. In our outsourcing protocol, we rst apply a secure and efcient transformation scheme at the client side to encrypt its private information. Then, we use the reduced gradient method and generalized gradient method at the server side to solve the transformed large-scale NLPs under linear constraints and nonlinear constraints, respectively. We provide security analysis of the proposed protocol, and evaluate its performance. The experimental results show that we can efciently solve the large-scale NLPs and save huge amount of time for the clients.

BCube is a well-known recursively defined network structure. It provides multiple low-diameter paths and good fault-tolerance for data center networks (DCNs). Its distributed routing algorithm, BCube Source Routing (BSR), can be deployed rapidly and conveniently to build multiple parallel path sets. But in the worst case, BSR may suffer from flow collisions and waste $50\%$ of the capacity of each BCube link. In this paper, to fully use those redundant links and to improve BCube load balancing, we supplement the BCube topology with a central master computer and we design two centralized dynamic parallel flow scheduling algorithms: CDPFS and CDPFSMP, for single-path and multi-path respectively. We focus on finding the least congested path for each flow by analyzing the information about the state of the global network. Furthermore, we allocate those paths to each flow in parallel. The simulation result shows that our proposed algorithms take advantage of BCube structure and deliver high-performance solutions for load balancing problems.

The satisfaction of a software requirement is commonly stated as a Boolean value, that is, a security requirement is either satisfied (true) or not (false). However, a discrete Boolean value to measure the satisfaction level of a security requirement by deployed mechanisms is not very useful. Rather, it would be more effective if we could quantify the level of satisfaction of security requirements on a continuous scale. We propose an approach to achieve this for cloud software systems based on relationships between defense strength, exploitability of vulnerabilities, and attack severity. We extend the concept of entailment relationship from the field of requirements engineering with the satisfiability aspects of security requirements. The proposed approach enables us to systematically structure security concepts into three sets of related descriptions to quantify the satisfaction level of security requirements with the deployed security solutions. To demonstrate the feasibility of the proposed approach, we evaluate the approach in a case study. As a result, security administrators are able to deploy more effective and appropriate security solutions based on their assessment.

Edge computing provides computing capability at close-user proximity to reduce service latency for end users. To improve the efficiency of edge computing infrastructures, geographically-distributed edge datacenters can co-work with each other and with cloud datacenters, forming a new paradigm referred to as cooperative edge-cloud computing. In this context, applications typically run on a virtual machine (VM) that can be replicated at multiple sites, and thus user traffic can be served at all the sites where corresponding VMs reside. For the performance of many applications, latency is a critical parameter. In this work, taking applications latencies as the primary constraint, we model the problem of VM placement and workload assignment as a mixed integer linear program and develop heuristic algorithms accordingly. The goal is to minimize the consumption of information technology (IT) infrastructures for placing VMs in cooperative edge-cloud computing, while meeting the heterogeneous latency demands of different applications. Some preliminary results indicate that edge datacenters resource efficiency can be optimized by proper cross-site VM placement and workload re-direction.

International audience; Internet of Things (IoT) applications often require the processing of data streams generated by devices dispersed over a large geographical area. Traditionally, these data streams are forwarded to a distant cloud for processing, thus resulting in high application end-to-end latency. Recent work explores the combination of resources located in clouds and at the edges of the Internet, called cloud-edge infrastructure, for deploying Data Stream Processing (DSP) applications. Most previous work, however, fails to scale to very large IoT settings. This paper introduces deployment strategies for the placement of DSP applications on to cloud-edge infrastructure. The strategies split an application graph into regions and consider regions with stringent time requirements for edge placement. The proposed Aggregate End-to-End Latency Strategy with Region Patterns and Latency Awareness (AELS+RP+LA) decreases the number of evaluated resources when computing an operator’s placement by considering the communication overhead across computing resources. Simulation results show that, unlike the state-of-the-art, AELS+RP+LA scales to environments with more than 100k resources with negligible impact on the application end-to-end latency.

To reduce the cost of human and material resources and improve the collaborations among medical systems, research laboratories and insurance companies for healthcare researches and commercial activities, electronic medical records (EMRs) have been proposed to shift from paperwork to friendly shareable electronic records. To take advantage of EMRs efficiently and reduce the cost of local storage, EMRs are usually outsourced to the remote cloud for sharing medical data with authorized users. However, cloud service providers are untrustworthy. In this paper, we propose an efficient, secure, and flexible EMR sharing system by introducing a novel cryptosystem called dual-policy revocable attribute-based encryption and tamper resistance blockchain technology. Our proposed system enables EMRs to be shared at a fine-grained level and allows data users to detect any unauthorized manipulation. Moreover, the key generation center can revoke malicious users without affecting the honest users. We provide the formal security model as well as the concrete scheme with security analysis. The experimental simulation and experimental analysis of our proposed scheme demonstrate that our proposed system has superior performances to the most relevant solutions.