Search

Software-Defined Networking (SDN) provides a programmable framework for multi-tenant cloud network management and orchestration. The end-to-end packet processing induced by virtual network functions (VNFs) like stateless firewall, load balancer, intrusion detection, and prevention system (IDPS) in a network involves the processing of network traffic through security policies matching the traffic pattern defined in security rules of individual VNF. The conflicting rules in terms of traffic match and conflicting actions can lead to a) violation of security requirements (authentication and authorization bypass) b) mission requirements - the presence of redundant rules (increased latency, reduced throughput). We present a new object-oriented policy conflict detection and resolution framework (OOPC), which analyzes the rule dependency relationships between the rules of heterogeneous virtual network functions (VNFs) and creates a VNF-Graph. The rules are analyzed using object-oriented dependencies between the address space and actions of VNF rules. OOPC utilizes a compact VNF-Graph, which leads to a reduction in search complexity when analyzing new security policies. Our security policy composition in our framework OOPC achieves 37% lower latency in policy graph composition than previous work. The proposed solution performs 20% faster security policy conflict detection on a cloud network with 60k OpenFlow rules than prior frameworks that serve a similar purpose.

Computation partitioning is an important technique to improve the application performance by selectively offloading some computations from the mobile devices to the nearby edge cloud. In a dynamic environment in which the network bandwidth to the edge cloud may change frequently, the partitioning of the computation needs to be updated accordingly. The frequent updating of partitioning leads to high state migration cost between the mobile side and edge cloud. However, existing works don't take the state migration overhead into consideration. Consequently, the partitioning decisions may cause significant network congestion and increase overall completion time tremendously. In this paper, we propose a set of novel algorithms to update the partitioning based on the changing network bandwidth. To the best of our knowledge, this is the first work on computation partitioning for stateful data stream applications in dynamic environments. The algorithms aim to alleviate the network congestion and minimize the make-span through selectively migrating state in dynamic edge cloud environments. Extensive simulations show our solution not only could selectively migrate state but also outperforms other classical benchmark algorithms in terms of make-span. The proposed model and algorithms will enrich the scheduling theory for stateful tasks, which has not been explored before.

Continuous verification of network security compliance is an accepted need. Especially, the analysis of stateful packet filters plays a central role for network security in practice. But the few existing tools which support the analysis of stateful packet filters are based on general applicable formal methods like Satifiability Modulo Theories (SMT) or theorem prover and show runtimes in the order of minutes to hours making them unsuitable for continuous compliance verification.In this work, we address these challenges and present the concept of state shell interweaving to transform a stateful firewall rule set into a stateless rule set. This allows us to reuse any fast domain specific engine from the field of data plane verification tools leveraging smart, very fast, and domain specialized data structures and algorithms including Header Space Analysis (HSA). First, we introduce the formal language FPL that enables a high-level human-understandable specification of the desired state of network security. Second, we demonstrate the instantiation of a compliance process using a verification framework that analyzes the configuration of complex networks and devices - including stateful firewalls - for compliance with FPL policies. Our evaluation results show the scalability of the presented approach for the well known Internet2 and Stanford benchmarks as well as for large firewall rule sets where it outscales state-of-the-art tools by a factor of over 41.

Processing-in-memory (PIM) seeks to eliminate computation/memory data transfer using devices that support both storage and logic. Stateful logic techniques such as IMPLY, MAGIC and FELIX can perform logic gates within memristive crossbar arrays with massive parallelism. Multiplication via stateful logic is an active field of research due to the wide implications. Recently, RIME has become the state-of-the-art algorithm for stateful single-row multiplication by using memristive partitions, reducing the latency of the previous state-of-the-art by 5.1x. In this paper, we begin by proposing novel partition-based computation techniques for broadcasting and shifting data. Then, we design an in-memory multiplication algorithm based on the carry-save add-shift (CSAS) technique. Finally, we develop a novel stateful full-adder that significantly improves the state-of-the-art (FELIX) design. These contributions constitute MultPIM, a multiplier that reduces state-of-the-art time complexity from quadratic to linear-log. For 32-bit numbers, MultPIM improves latency by an additional 4.2x over RIME, while even slightly reducing area overhead. Furthermore, we optimize MultPIM for full-precision matrix-vector multiplication and improve latency by 25.5x over FloatPIM matrix-vector multiplication., Accepted to IEEE Transactions On Circuits And Systems-II (TCAS-II)

In some digital signature schemes, the signer needs to maintain a dynamic state while signing messages. These are called stateful signature schemes. Although stateful signature schemes are commonly used as cryptographic primitives, they do not fit the standard definition of a signature scheme in cryptography. In this work, formal and general definitions for stateful signature schemes are given. In the definitions of security notions, various scenarios are considered where the adversaries have different levels of control over the signing oracle in terms of messages and states. After that, generic constructions of stateful signature schemes with different security levels are provided. In addition, some black‐box constructions of stateful signature schemes that can be instantiated by primitives under any assumptions are given. Note that the constructions in this work are proven to be secure in standard models.

Stateful logic through memristor is a promising technology to build Computing-in-Memory (CIM) systems. However, aging-induced degradation of memristors' threshold voltage imposes a major challenge to the reliability and guardbands estimation of memristive CIM systems, especially the Material Implication (IMPLY) logic based CIM systems. In this paper, a novel in-situ aging-aware error monitoring scheme for memristor-based IMPLY logic is proposed. The proposed in-situ error monitoring scheme can achieve faster error detection speed and higher detection accuracy than the straightforward program-verify monitoring scheme. Simulation results under Monte-Carlo simulation show that the proposed monitoring scheme can effectively detect the major operation failures existing in IMPLY logic operations with a detection accuracy up to 99.95%. Moreover, a case study of error monitoring design of 4-bit IMPLY-based adder is carried out. The analysis result exhibits that the proposed in-situ monitoring scheme can achieve 75.2% improvement on the detection speed against the program-verify scheme. Further analysis on a convolution filter in VGG-11 based Binarized Neural Network shows that 74% improvement on the detection speed can also be achieved by using the proposed monitoring scheme, which suggests that the proposed in-situ error monitoring scheme is an efficient solution to improve the reliability of IMPLY-based memristive CIM systems.

This work aims at distilling a systematic methodology to modernize existing sequential scientific codes with a little re-designing effort, turning an old codebase into modern code, i.e., parallel and robust code. We propose a semi-automatic methodology to parallelize scientific applications designed with a purely sequential programming mindset, possibly using global variables, aliasing, random number generators, and stateful functions. We demonstrate that the same methodology works for the parallelization in the shared memory model (via OpenMP), message passing model (via MPI), and General Purpose Computing on GPU model (via OpenACC). The method is demonstrated parallelizing four real-world sequential codes in the domain of physics and material science. The methodology itself has been distilled in collaboration with MSc students of the Parallel Computing course at the University of Torino, that applied it for the first time to the project works that they presented for the final exam of the course. Every year the course hosts some special lectures from industry representatives, who present how they use parallel computing and offer codes to be parallelized.

An increasing number of Low Latency Applications (LLAs) in the entertainment, IoT, and automotive domains require response times that challenge the traditional application provisioning using distant Data Centres. Fog computing paradigm extends cloud computing at the edge and middle-tier locations of the network, providing response times an order of magnitude smaller than those that can be achieved by the current "client-to-cloud" network model. Here, we address the challenges of provisioning heavily stateful LLA in the setting where fog infrastructure consists of third-party computing resources, i.e., cloudlets, that comes in the form of "data centres in the box". We introduce FogSpot, a charging mechanism for on-path, on-demand, application provisioning. In FogSpot, cloudlets offer their resources in the form of Virtual Machines (VMs) via markets, collocated with the cloudlets, that interact with forwarded users' application requests for VMs in real time. FogSpot associates each cloudlet with a spot price based on current application requests. The proposed mechanism's design takes into account the characteristics of cloudlets' resources, such as their limited elasticity, and LLAs' attributes, like the expected QoS gain and engagement duration. Lastly, FogSpot guarantees end users' requests truthfulness while focusing in maximising either each cloudlet's revenue or resource utilisation.

Serverless, or Functions-as-a-Service (FaaS), is an increasingly popular paradigm for application development, as it provides implicit elastic scaling and load based billing. However, the weak execution guarantees and intrinsic compute-storage separation of FaaS create serious challenges when developing applications that require persistent state, reliable progress, or synchronization. This has motivated a new generation of serverless frameworks that provide stateful abstractions. For instance, Azure's Durable Functions (DF) programming model enhances FaaS with actors, workflows, and critical sections. As a programming model, DF is interesting because it combines task and actor parallelism, which makes it suitable for a wide range of serverless applications. We describe DF both informally, using examples, and formally, using an idealized high-level model based on the untyped lambda calculus. Next, we demystify how the DF runtime can (1) execute in a distributed unreliable serverless environment with compute-storage separation, yet still conform to the fault-free high-level model, and (2) persist execution progress without requiring checkpointing support by the language runtime. To this end we define two progressively more complex execution models, which contain the compute-storage separation and the record-replay, and prove that they are equivalent to the high-level model.

Fault-tolerance is an essential part of a stream processing system that guarantees data analysis could continue even after failures. State-of-the-art distributed stream processing systems use checkpointing to support fault-tolerance for stateful computations where the state of the computations is periodically persisted. However, the frequency of performing checkpoints impacts the performance (utilization, latency, and throughput) of the system as the checkpointing process consumes resources and time that can be used for actual computations. In practice, systems are often configured to perform checkpoints based on crude values ignoring factors such as checkpoint and restart costs, leading to suboptimal performance. In our previous work, we proposed a theoretical optimal checkpoint interval that maximizes the system utilization for stream processing systems to minimize the impact of checkpointing on system performance. In this article, we investigate the practical benefits of our proposed theoretical optimal by conducting experiments in a real-world cloud setting using different streaming applications; we use Apache Flink, a well-known stream processing system for our experiments. The experiment results demonstrate that an optimal interval can achieve better utilization, confirming the practicality of the theoretical model when applied to real-world applications. We observed utilization improvements from 10% to 200% for a range of failure rates from 0.3 failures per hour to 0.075 failures per minute. Moreover, we explore how performance measures: latency and throughput are affected by the optimal interval. Our observations demonstrate that significant improvements can be achieved using the optimal interval for both latency and throughput.

A Futuristic Operating transactions Reaching beyond Territorial borders In blockchain Smart contract model (Fortis-amyna) for cross border transactions in a quantum setting is proposed. A simple hybrid classical-quantum model has been described whose main ingredients are a classical blockchain capable of handling stateful smart contracts with quantum defence. This hybrid payment model uses quantum states as bank transactions and a classical blockchain to settle disputes and keep track of the valid reference numbers. The proposed model fortis amyna has several desirable properties like de-centralized, requiring no trust in any single entity; Quick payments as quantum communication, regardless of the total number of users to speed up the transactions. In addition, fortis amyna handles the situation in lighting speed in quantum bank-transaction if failed or has error due to connectivity, helping the initiator to track back the transaction from origin. This fortis amyna model has tremendous advantages regarding speed, security, and authentication, guarding against quantum breaches. Ensuring more authenticity to customers and creating by linking a Distinct (De-Centralized) Identifier with blockchain’s current transaction state eventually leads to the updated digital ledger.

A hypervisor switch, such as Open vSwitch (OVS), plays a key role in the virtualized data centers implementing overlay networking to provide network isolation. The hypervisor switch is running on each compute node as a software application and switches packets between virtual machines. Software switches frequently require upgrading and customization of network protocol’s stack to introduce novel or domain-specific networking techniques. However, it is still difficult to extend OVS to support new network features as it requires mastery of network protocol design, programming expertise, and familiarity with the complex codebase of OVS. Moreover, there is currently no solution that enables the deployment of network features recompilation of OVS. In this article, we present P4rt-OVS, an original extension of OVS that enables runtime programming of protocol-independent and stateful packet processing pipelines. It extends the forwarding model of OVS with the userspace Berkeley Packet Filter (uBPF), bringing a new extensibility mechanism. Moreover, P4rt-OVS comes with a P4-to-uBPF compiler, which allows developers to write data plane programs in the high-level P4 language, compile them to the BPF bytecode and inject them to the OVS packet processing pipeline at runtime. Our design results in a hybrid approach that provides P4 programmability without sacrificing the well-known features of OVS. We provide thorough performance results, including end-to-end performance tests, microbenchmarks and a performance test of an exemplary network application (Broadband Network Gateway). The performance evaluation shows that P4rt-OVS does not introduce significant processing overhead, yet enables runtime protocol extensions and stateful packet processing. Moreover, we discuss features of P4rt-OVS and provide programming guidelines to help developers achieve the best performance of P4 programs for P4rt-OVS.

The multi-resource allocation problem arises in different scenarios. Different mechanisms have been proposed to fairly divide multiple resources, most notably, Dominant Resource Fairness (DRF). Even though DRF satisfies several desirable properties, it considers fairness only in the static setting. We propose Stateful DRF (SDRF), an extension of DRF that looks at past allocations and enforces fairness in the long run while keeping the fundamental properties of DRF. We prove that SDRF is strategyproof, since users cannot manipulate the system by misreporting their demands; incentivizes sharing, because no user is better off if resources are equally partitioned; and is efficient, as no allocation can be improved without decreasing another. In SDRF, users’ priorities change over time. To avoid recalculating priorities at every task scheduling decision, we also propose Live Tree, a data structure that keeps elements with predictable time-varying priorities ordered. We implement SDRF on Mesos and run it in a real cluster. Moreover, we conduct large-scale simulations based on Google cluster traces of 30 million tasks over one month. Results show that SDRF reduces users’ waiting time on average. This improves fairness, by increasing the number of completed tasks for users with lower demands, with negligible impact on high-demand users.

Containerization is a leading technological advancement in cloud-native developments. Virtualization isolates the running processes at the bare metal level but containerization isolates the processes at the operating system level. Virtualization encapsulates all the new virtual instances with a new operating system but containerization encapsulates the software only with its dependencies. Containerization avoids the problem of dependency missing between different operating systems and their distributions. The concept of containerization is old but the development of open-source tools like Docker, Kubernetes, and Openshift accelerated the adaption of this technology. Docker builds container images and Openshift or Kubernetes is an Orchestrating tool. For stateful applications, Kubernetes workload resources are not a better option to orchestrate the application, as each resource has its own identity. In such cases, the operator can be built to manage the entire life cycle of resources in the Kubernetes cluster. Operator combines human operational knowledge into software code in a systematic way. The paper discusses the default control mechanism in Kubernetes and then it explains the procedure to build the operator to orchestrate the stateful application.

In this work, we discuss in detail a flaw in the original security proof of the W-OTS${^+}$ variant of the Winternitz one-time signature scheme, which is an important component for various stateless and stateful many-time hash-based digital signature schemes. We update the security proof for the W-OTS${^+}$ scheme and derive the corresponding security level. Our result is of importance for the security analysis of hash-based digital signature schemes., Comment: 16 pages, 1 figure, 1 table

Previous works suggested different approaches to implementing service chaining. Their goal is to enhance the performance of the middleboxes and satisfy the expectations of the cloud providers and users. To meet these expectations, the delay factor, i.e., flow through the low-cost paths, as well as the best node processing factor, are considered. Achieving these two goals simultaneously turns the middlebox optimal placement into an NP-hard problem. Therefore, when the problem size is large, it is infeasible to obtain an optimal solution at a reasonable time. One of the important issues which has not been considered in the previous works is stateful optimal placement when receiving a new request. Due to resource constraints as well as financial costs for the customers, it is not possible to create functions for all requests. Therefore, not only it is possible to integrate the same network functions between new flows, but it will also be examined between new on-demand network functions as well as existing ones. Our proposed approach not only reduces the creation of network functions that can be cost-effective for the customer but also because of the migration of previous network functions (integration with on-demand network functions) to optimize new requests, overall, it will optimize the entire network cost over time. We formulated the problem as 0-1 programming problem. The results of this article are based on a fat-tree data center. To show that our stateful solution is scalable in large networks, we use network zoning and topology partitioning heuristics. Our simulations show that we were able to scale our placement model to a network with 54K nodes and 1.5M edges.

With the fast approach of the end of silicon scaling and existing problems, such as the Von-Neumann bottleneck, alternative computing paradigms are in demand. In-memory computation (IMC) is one of the most promising solutions, and memristive technology is one of the best platforms for that purpose. Many logic families have been proposed to enable memristive IMC, among which stateful logic family stands out due to its minimal power consumption and simplicity. In this work, to complement existing works, we propose the first stateful crossbar-compatible XOR atomic logic operation that requires only one cycle for its completion, which is two times faster than the current minimum required time for performing XOR (which is two cycles) using other atomic operations in comparable memristive stateful logic families. We show that, in an example case of an adder, by taking advantage of the proposed single-cycle in-memristor XOR (SIXOR), up to $4.5\times $ speedup can be achieved compared to other SoA stateful adders. The gained speed-up scales up in more complex systems and calculations that use XOR .

Processing-in-memory (PIM) exploits massive parallelism with high energy efficiency and becomes a promising solution to the von Neumann bottleneck. Recently, the emerging metal-oxide resistive random access memory (RRAM) shows its potential to construct a PIM architecture, because several stateful logic operations, e.g., IMP and NOR, can be executed in an RRAM crossbar in parallel. Previous synthesis flows focus on improving latency with stateful logic operations, but they ignore that the memory should be used primarily for storage. i.e., most of the area in the crossbar is used for computation but not storage. In this situation, storage and computation still have to be separated into different crossbars, which leads to considerable data transfer overhead and limited parallelism. In this work, we define the ratio of storage in a crossbar as area utilization. We aim to improve the area utilization without throughput loss by proposing STAR, a novel synthesis flow for the stateful logic. We present two optimization strategies to reduce the computation area in STAR. First, we reduce the area for redundant inputs. For the shared constants among different rows (or columns), we encode them as immediate values into the control signals without writing them into the crossbar at runtime. For the other inputs, we only store one copy of them in the crossbar. Second, we reduce the area for intermediate variables by reusing invalid cells. And we design a scheduling algorithm to find a computation sequence with the minimal variable erasing cycles. Invalid primary inputs can also be erased in this algorithm. Furthermore, we present a case study of the image convolution to demonstrate the effectiveness of STAR. Experimental evaluation shows that STAR achieves 33.03% more area utilization and a 1.43x throughput compared to SIMPLER, the state-of-the-art stateful logic synthesis flow. Our image convolution implementation also provides 78.36% more area utilization and a 1.48x throughput compared with IMAGING, the state-of-the-art stateful logic-based image processing accelerator.

In this article, unlike almost all state-of-the-art obfuscation solutions that focus on functional/logic obfuscation, we introduce a new paradigm, called data flow obfuscation, which exploits the essence of asynchronicity. In data flow obfuscation, by benefiting from the handshaking mechanism of asynchronous circuits, the system’s FFs/latches will operate out of sync. Hence, the adversary has no sufficient knowledge to apply unrolling/BMC. Also, due to the inherited asynchronicity, the exact time of writing/capturing data into/from the scan chain becomes hidden. Hence, the SAT attack cannot be applied even while scan chain access is open. Moreover, our new proposed paradigm creates stateful/oscillating combinational cycles into the design which extensively boosts the difficulty of modeling this technique. We also demonstrate how data flow obfuscation could easily be integrated with any circuit at low overhead while there is no limitation such as compromising test flow.

Per-flow connection state monitoring is crucial for detecting malicious traffic or anomalies in networks. The monitoring is extremely challenging in high-speed networks, and would involve high computation and memory costs. We propose a novel stateful Bloom filter (stateBF) to enable a highly compact, low-overhead, and accurate flow-state storage service for the monitoring of the per-flow connection states. Unlike the standard Bloom filter and its various extensions, we design a special cell-based data structure for stateBF instead of bit array to track both the state value and the number of times the same state value is inserted to stateBF. We further design four stateBF operations for advanced flow-state management. To enable efficient stateBF operations, they are designed to be bitwise for the simple implementation. We have done extensive simulations with data traces from public MAWI and from a university campus. Our performance results demonstrate that stateBF can support per-flow state storage services in high speed networks with low storage space, and high querying speed and accuracy.

Named data networking (NDN), as a specific architecture design of information-centric networking (ICN), has quickly became a promising candidate for future Internet architecture, where communications are driven by data names instead of IP addresses. To realize the NDN communication paradigm in the future Internet, two important features, stateful forwarding and in-network caching, have been proposed to cope with drawbacks of host-based communication protocols. The stateful forwarding is designed to maintain the state of pending Interest packets to guide Data packets back to requesting consumers, while the in-network caching is used to reduce both network traffic and data access delay to improve the overall performance of data access. However, the conventional stateful forwarding approach is not adaptive and responsive to diverse network conditions because it fails to consider multiple network metrics to make Interest forwarding decision. In addition, the default in-network caching strategy relies on storing each received Data packet regardless of various caching constraints and criteria, which causes the routers in the vicinity of data producers to suffer from excessive caching overhead. In this paper, we propose the Pro NDN , a novel stateful forwarding and in-network caching strategy for NDN networks. The Pro NDN consists of multicriteria decision-making (MCDM) based interest forwarding and cooperative data caching. The basic idea of the MCDM-based interest forwarding is to employ Technique for Order Performance by Similarity to Idea Solution (TOPSIS) to dynamically evaluate outgoing interface alternatives based on multiple network metrics and objectively select an optimal outgoing interface to forward the Interest packet. In addition, the cooperative data caching consists of two schemes: CacheData, which caches the data, and CacheFace, which caches the outgoing interface. We conduct extensive simulation experiments for performance evaluation and comparison with prior schemes. The simulation results show that the Pro NDN can improve Interest satisfaction ratio and Interest satisfaction latency as well as reduce hop count and Content Store utilization ratio.

Since Network Function Virtualization (NFV) decouples network functions (NFs) from the underlying dedicated hardware and realizes them in the form of software called Virtual Network Functions (VNFs), they are enabled to run in any resource-sufficient virtual machines. A service function chain (SFC) is composed of a sequential set of VNFs. As VNFs are vulnerable to various faults such as software failures, we consider how to deploy both active and standby SFC instances. Given the complexity and unpredictability of the network state, we propose a double deep Q-networks based online SFC placement scheme DDQP. Specifically, DDQP uses deep neural networks to deal with large continuous network state space. In the case of stateful VNFs, we offer constant generated state updates from active instances to standby instances to guarantee seamless redirection after failures. With the goal of balancing the waste of resources and ensuring service reliability, we introduce five progressive schemes of resource reservations to meet different customer needs. Our experimental results demonstrate that DDQP responds rapidly to arriving requests and reaches near-optimal performance. Specifically, DDQP outweighs the state-of-the-art method by 16.30% and 38.51% higher acceptance ratio under different schemes with 82x speedup on average. In order to enhance the integrity of the SFC state transition, we further proposed DDQP+, which extends DDQP by adding the delayed placement mechanism. Compared with DDQP, the design of the DDQP+ algorithm is more reasonable and comprehensive. The experiment results also show that DDQP+ achieved further improvement in multiple performance indicators.

A Click-based network function (NF) has significant advantages for pipeline development, including modularity, extensibility, and programmability. Despite these features, its internal architecture has unfortunately not kept up with some specific problems of the software upgrade. To motivate our article, we analyzed a series of use cases to identify the limitations of native Click. These limitations include the inefficiencies in modifying modules, integrating modules, and recovering states. To bridge the gap, we present three novel enhancements in our Click upgrade (Click-UP) system: 1) modular state abstraction refines each type of stateful operations as an atom operation and decouples it from the pipeline, letting separately managing logics for stateless operations and stateful operations become practical; 2) essential module integration manages dependencies between modules, avoiding shipping unnecessary modules with neutral functionalities to the target NF; and 3) local state migration migrates needed states seamlessly from the old NF to the target NF at local memory. Our evaluation demonstrates that Click-UP reduces the context code required for module modification by 12–81%, cutting down the NF integration time by 78–96% and the service disruption time by 76–93%, as compared to the software upgrade performance represented by native Click.

A few sensing techniques have been developed for detecting defects in civil infrastructures in structural health monitoring (SHM) instead of onsite human inspection. Many false alarms observed are due to faults in sensors, and some of them may lead to incorrect interpretation of the measured data. In this paper, the differentiation of different sources of variability, i.e. the sensor fault and structural damage, is investigated for a vibration-based SHM system. A deep learning-based method with a new architecture of Fully connected Stateful Long Short Time Memory (FS-LSTM) Neural Networks for differentiating the sensor fault and structural damage without information on details of the fault is proposed. Information from the sensor fault is assumed local, and that from structural damage is relatively global affecting several sensors. Since the LSTM are capable to learn data features automatically, the proposed method performs well without an accurate mathematical model. Stationary random acceleration responses of a three-span continuous bridge when under operational conditions are studied. A deep network model is applied to the measured data with estimation on four types of sensor fault. The response residues between the true and predicted values of the deep FS-LSTM NN is statistically analyzed to determine the threshold of sensor fault. An experimental study with a steel frame in the laboratory is also performed to validate the proposed method.

Data center networks offer multiple parallel paths between a source-destination pair. But, due to the use of TCAM based single logical step ‘path-search and selection’ mechanism in the switches, most of the existing packet forwarding systems can utilize only a single-best path. It prevents them from utilizing the benefit of multiple paths for achieving application-specific QoS objectives. In this work, we propose P4KP, a programmable switch-based novel scheme for utilizing the top-k best paths toward a destination in a QoS-aware manner. P4KP complements TCAM’s path-selection capability using SRAM; decouples path-searching from path-selection and facilitates the path-selection using an SRAM-based data structure. Its SRAM-based data structure reduces costly TCAM usage and enables the efficient update of the top-k best paths in the data plane. P4KP also provides a bitmask-based API to express the QoS-based policy for selecting one-of-the-top-k best paths. We implemented P4KP using P4 language to demonstrate that it is realizable in currently available programmable switches while maintaining line-rate throughput. Our preliminary evaluation shows that P4KP significantly reduces the stateful memory consumption in programmable switches and achieves improved performance.

Digital twins of processes and devices use information from sensors to synchronize their state with the entities of the physical world. The concept of stream computing enables effective processing of events generated by such sensors. However, the need to track the state of an instance of the object leads to the impossibility of organizing instances of digital twins as stateless services. Another feature of digital twins is that several tasks implemented on their basis require the ability to respond to incoming events at near-real-time speed. In this case, the use of cloud computing becomes unacceptable due to high latency. Fog computing manages this problem by moving some computational tasks closer to the data sources. One of the recent solutions providing the development of loosely coupled distributed systems is a Microservice approach, which implies the organization of the distributed system as a set of coherent and independent services interacting with each other using messages. The microservice is most often isolated by utilizing containers to overcome the high overheads of using virtual machines. The main problem is that microservices and containers together are stateless by nature. The container technology still does not fully support live container migration between physical hosts without data loss. It causes challenges in ensuring the uninterrupted operation of services in fog computing environments. Thus, an essential challenge is to create a containerized stateful stream processing based microservice to support digital twins in the fog computing environment. Within the scope of this article, we study live stateful stream processing migration and how to redistribute computational activity across cloud and fog nodes using Kafka middleware and its Stream DSL API.

A seamless, reconfigurable, and highly parallel in-memory stochastic computing (SC) approach is proposed and experimentally demonstrated in resistive random access memory (RRAM) array. By utilizing the probabilistic switching behavior of RRAM and parallel writing, stochastic bit streams (SBS) are generated in parallel. By employing in-memory stateful logic, parallel stochastic logic is directly performed within the same memory array. This in-memory SC approach has three merits: 1) true stochastic number generator (SNG) can be obtained with low cost, 2) the signal conversion overhead between SNG and stochastic logic is eliminated, 3) it is highly parallel and the stochastic logic is reconfigurable. This work provides an efficient and low-cost alternative approach to achieve SC.

This work presents a network processing unit based on specialized computational cores that is used for packet processing in network devices (e.g. in network switches). Nowadays stateful data-plane algorithms are developing in software-defined networks. The idea of stateful data-plane algorithms is to move a part of control information from control plane to data plane. But these algorithms require hardware support because they need resources for state handling. This work presents the network processing unit architecture modifications that allow to use stateful data-plane algorithms that require state synchronization between the NPU processing pipelines.

A cluster deduplication system can coordinate the work of multiple nodes, which can better alleviate the disk index bottleneck existing in the large-scale data backup system. However, there is a problem of isolated islands of information among nodes during data deduplication. When the servers use the query mode to route data, a large amount of system overhead is required to ensure a high deduplication rate and low throughput rate. At the same time, while the servers cannot obtain a higher deduplication rate if the servers adopt the stateless routing method. Data routing strategy can greatly affect the overall performance of the system. The concept of data frequency is proposed in this paper, and the classified routing strategy is designed. In the metadata server, a byte-shaped Bloom filter for recording the occurrence frequency of data blocks is maintained to record the occurrence frequency of data blocks. The values in the Bloom filter are counted. Then the frequency of the data blocks is compared with the configured threshold value to determine whether the data is “hot data”. We use stateful routing to send “clod data” to the storage nodes and use stateless routing to send the hot data to the storage nodes. Experimental results show that the classifying routing algorithm based on the frequency of data can greatly reduce the overhead of the system while guaranteeing the deduplication rate of the deduplication system as well as improve system throughput and real-time processing capabilities. Compared with the fully stateful routing scheme, our method only loses less than 2% of the deduplication rate, which reduces the communication query overhead by more than 25% and improves the real-time processing capability of the storage system.

A structured overlay technology has the advantages for fault tolerance and computation resource (i.e., node) discovery in distributed data storage and its computation platform, however, these strengths are only guaranteed on stable environment that node failures do not occur frequently. To deal with the environment, many advanced schemes based on the well-known node failure information propagation scheme are proposed, which stabilizes the platform by quickly handling node failures. In the existing scheme, a computation node propagates a node-failure information when the node detect its failure. However, the existing scheme needs stateful maintenance against propagation targets; in other words, it must maintain the network connections of both the propagation target nodes and the nodes held on the general overlay. The nodes then exhaust the machine resources (e.g., CPU, memory, network bandwidth) for the connection management and cannot concentrates on their own tasks, such as data analysis or its storage application. To resolve this problem, I propose a stateless node-failure information propagation scheme, which propagates a node failure at the speed of the existing scheme but without requiring maintenance of the propagation target connections. In the proposed scheme, each computational node can effectively utilize the machine resources for its own task. Instead of retaining the propagation targets, my scheme estimates the propagation targets after detecting a node failure. I analyzed the estimation accuracy of a simple propagation model, which guarantees effective propagation. The accuracy was found to depend on the overlay distance between the failed node and the propagator node. Based on this observation, my scheme adjusts the keep-alive interval to bias the detection of closer node failures. In a simulation evaluation, the detection delay of the proposed stateless propagation was similar to that of the stateful propagation scheme, but delivered superior maintenance cost and scalability.

Serverless, a new cloud-based architecture, brings development and deployment flexibility to a new level by significantly decreasing the size of the deployment units. Nevertheless, it still hasn’t been clearly defined for which applications it should be employed and how to use it most effectively, and this is the focus of this research.The study uses Microsoft Azure Functions – one of the popular mature tools – because of its stateful orchestrators – Durable Functions. The tool is used to present and describe four flexible serverless patterns with code examples.The first pattern is HTTP nanoservices. The example demonstrates how flexible can be the Function-as-a-Service model, which uses relatively small functions as deployment units.The second usage scenario described is a small logic layer between a few other cloud services. Thanks to its event-driver nature, serverless is well-suited for such tasks as making an action in one service after a specific event from another one. New functions easily integrate with the API from the first example.The third scenario – distributed computing – relies on the ability of Durable Functions to launch a myriad of functions in parallel and then aggregate their results. and distributed computing. A custom MapReduce implementation is presented in this section.The last pattern described in this research significantly simplifies concurrent working with mutable data by implementing the actor model. Durable Entities guarantee that messages are delivered reliably and in order, and also the absence of deadlocks.The results of this work can be used as a practical guide to serverless main concepts and usage scenarios. Main topic of future research was chosen to be the development of a full-fledged serverless application using typical patterns to study the architecture in more depth.Manuscript received 08.06.2020

Digital twins of processes and devices use information from sensors to synchronize their state with the entities of the physical world. The concept of stream computing enables effective processing of events generated by such sensors. However, the need to track the state of an instance of the object leads to the impossibility of organizing instances of digital twins as stateless services. Another feature of digital twins is that several tasks implemented on their basis require the ability to respond to incoming events at near-real-time speed. In this case, the use of cloud computing becomes unacceptable due to high latency. Fog computing manages this problem by moving some computational tasks closer to the data sources. One of the recent solutions providing the development of loosely coupled distributed systems is a Microservice approach, which implies the organization of the distributed system as a set of coherent and independent services interacting with each other using messages. The microservice is most often isolated by utilizing containers to overcome the high overheads of using virtual machines. The main problem is that microservices and containers together are stateless by nature. The container technology still does not fully support live container migration between physical hosts without data loss. It causes challenges in ensuring the uninterrupted operation of services in fog computing environments. Thus, an essential challenge is to create a containerized stateful stream processing based microservice to support digital twins in the fog computing environment. Within the scope of this article, we study live stateful stream processing migration and how to redistribute computational activity across cloud and fog nodes using Kafka middleware and its Stream DSL API.

The low-power Internet of Things (IoT) introduces lossy radio links with ultra-constrained frame sizes and high transmission cost for each byte. Information Centric Networking (ICN) is considered a promising communication technology in this regime, as it increases reliability by ubiquitous caching and eases transmission efforts by hop-wise forwarding. Common ICN layers such as NDN, however, were designed for fixed network infrastructure and require an adaptation layer to the constrained wireless—as the common Internet Protocol does. In this paper, we design and evaluate such an ICN convergence layer for low power lossy links that (1) augments the NDN stateful forwarding plane with a highly efficient name eliding, (2) devises stateless compression schemes for standard NDN use cases with utile data encodings, (3) adapts NDN packets to the small MTU size of IEEE 802.15.4, and (4) generates compatibility with 6LoWPAN so that IPv6 and NDN can coexist on the same LoWPAN links. Our findings indicate that stateful compression can reduce the size of NDN data packets by more than 70 % in realistic examples, while packet fragmentation operates in a predictable way even for high fragment numbers. Our experiments show that for common use cases ICNLoWPAN saves 33 % of transmission resources over NDN, and about 20 % over 6LoWPAN.

An elastic stream computing system needs elastic adjustment of computing resource allocation and vertex parallelism to improve latency and throughput, which includes continuously or periodically scaling in/out the workload of computing nodes at runtime. Dynamic redirection can help with this elasticity issue by dynamically redirecting real-time data streams to computing resources. Due to the time-varying and unpredictable nature of real-time data streams, implementing redirection of data streams is challenging. Currently, the requirements of data streams redirection are not fully fulfilled, which directly affects the latency and throughput of stream computing systems. To bridge this gap, we proposed a dynamic redirection framework (called Dr-Stream) for elastic stream computing systems. This paper discussed the following aspects: (1) Investigating the dynamic redirection of real-time data streams, providing a general stream application model, a data stream model and a data stream grouping model, as well as formalizing the problem of load balancing optimization and data stream redirection. (2) Redirecting data streams among multiple instances of an operator at runtime by a lightweight load balancing strategy to improve the load balancing of a data center at the vertex level. Managing system states, especially the states of stateful operators by a logical ring-based strategy to improve accuracy. (3) Determining the number of instances for each operator, and deploying the instance(s) to computing nodes by a modified first-fit strategy at runtime. (4) Evaluating the fulfillment of low latency, high throughput, and load balancing objectives in a real-world distributed stream computing environment. Experimental results showed that Dr-Stream reduced the average system latency and load balancing of the data center by more than 20% and 15%, respectively. It also improved the average system stability by more than 15% and avoided over-utilization of computing nodes, as compared to the existing strategies in Storm.

Memristor is a non-volatile new technology memory where the data stored as a resistance which the performance is influenced by the stateful logic design. Therefore, this study is an attempt to investigate the performance of the MAGIC NOR Gate stateful logic design using LTSPICE and targeted to 2 bits memory application. The objective is to investigate the performance of memristor based stateful logic logic design and schematics for memory application. Furthermore, the study been carried out by implementing the MAGIC NOR gate stateful logic schematic, then simulate the design in order to see the effects of performance including the electrical parameters compared to the others. Evidently, the improvement of MAGIC NOR gate contributes in reducing the number of NOR gate and CMOS count. Besides, the MAGIC NOR gates takes parallel inputs topology and eliminate the threshold voltage compared to IMPLY logic. Nevertheless, larger numbers of memristor required to stable the output consistency in MAGIC NOR gate schematic.

Traditional firewalls employ listed rules in both configuration and process phases to regulate network traffic. However, configuring a firewall with listed rules may create rule conflicts, and slows down the firewall. To overcome this problem, we have proposed a Tree-rule firewall in our previous study. Although the Tree-rule firewall guarantees no conflicts within its rule set and operates faster than traditional firewalls, keeping track of the state of network connections using hashing functions incurs extra computational overhead. In order to reduce this overhead, we propose a hybrid Tree-rule firewall in this paper. This hybrid scheme takes advantages of both Tree-rule firewalls and traditional listed-rule firewalls. The GUIs of our Tree-rule firewalls are utilized to provide a means for users to create conflict-free firewall rules, which are organized in a tree structure and called 'tree rules'. These tree rules are later converted into listed rules that share the merit of being conflict-free. Finally, in decision making, the listed rules are used to verify against packet header information. The rules which have matched with most packets are moved up to the top positions by the core firewall. The mechanism applied in this hybrid scheme can significantly improve the functional speed of a firewall.

Memristor-based stateful logic circuits can perform logic operations and logic value storage, which creates an intriguing opportunity for the implementation of an advanced computational architecture. This study proposes a novel memristor-based stateful logic implementation. Specifically, the presented approach is capable of realising two-input or multi-input AND, OR, NAND and NOR operations, and single-input COPY and NOT operations. In each logic gate, non-volatile resistances of memristor are used as input and output states, thus enabling stateful logic operations. Compared with several existing approaches, the proposed method can lead to a multi-functional stateful logic circuit, performing multiple stateful logic operations simultaneously. The effectiveness of the proposed design is demonstrated with the simulation results of MATLAB and SPICE.

TCP SYN Flood as one kind of Denial of Service (DoS) attack, still popular to flood the server connection, by sending SYN packets to the target. Because of the risk caused by this attack, there is a need for a network security mechanism. In this paper, one of the security mechanisms proposed is using Stateful Packet Inspection (SPI) method on Configserver Security and Firewall (CSF). By using SPI method, CSF has capabilities to responsible for separating packets of data, that may be entered with data packets that should not be entered into the server. For example: port to be opened, port closed, and IP Address that may access the server for anywhere. This paper combines both of CSF and SPI method to prevent TCP SYN Flood (DoS) with Proof of Concept (PoC) at the Linux operating system. The security process is done in 3 ways: configuring a maximum connection from an IP Address to a server, securing an incoming SYN packet per second, and counting how many times an IP Address violates the minimum SYN packet rule per second before being blocked by a firewall.