In modern computer systems, system event logs have always been the primary source for checking the system status. As computer systems become more complex, such as cloud computing systems, the interaction among software and hardware is increasingly frequently. These components will generate enormous log information, including running reports and fault information. The massive data is a great challenge for analysis with manual method. In this paper, we implement a log management and analysis system, which can assist system administrators to understand the real-time status of the entire system, classify logs into different fault types, and determine the root cause of the faults. In addition, we improve the existing fault correlation analysis method based on the results of system log classification. We apply the log management and analysis system to cloud computing environment for evaluation. The results show that our system can classify fault logs effectively and automatically. By using the proposed system, administrators can easily detect the root cause of faults.

Workflows are often used to represent enterprise-type activities, and authorisation control is an important security consideration in enterprise-level applications. Role-Based Access Control (RBAC) is a popular authorisation control scheme under which users are assigned to certain roles, and the roles are associated with permissions. This paper presents a novel mechanism for modelling workflow execution in cluster-based resource pools under Role-Based Access Control (RBAC) schemes. Our modelling approach uses Coloured Timed Petri-Nets, and various authorisation constraints are modelled, including role constraints, temporal constraints, cardinality constraints, Binding of Duty and Separation of Duty constraints, etc. The interactions between workflow authorisation and workflow execution are also captured in the model. In this paper, the modelling mechanism is developed in such a fashion that the construction of the authorisation model for a workflow can be automated. This feature is very helpful in modelling a large collection of authorisation policies or complex workflows. A Petri-net simulation tool, the CPN-Tool, is utilised to implement the developed modelling mechanism and simulate the constructed model. Both system-level performance (e.g., utilisation of resource pools) and application-level performance (e.g., workflow response time) can be obtained from model simulations. This work can be used to plan system capacity and investigate the impact of authorization policies on system and application performance.

Normal 0 7.8 磅 0 2 false false false EN-US ZH-CN X-NONE MicrosoftInternetExplorer4 Virtual machine technology can enhance server utilization and consolidation on an individual physical machine. In a growing number of contexts, many of which require high-performance networking inside of the system. Unfortunately, the development of virtualization technology is inclined to application isolation as yet, leads high communication overheads between virtual machines which are resident on the same physical machine , and also limits the achievable network performance. S ome efforts have been paid to bridge the network I/O performance gap between the virtualization and native environment, but the amelioration is not satisfactory. In this paper, we propose a system called IDTS ( Inter-Domain Transferring System ) which uses the shared memory between different domains (also called hosted or guest OSes) to expand the communication bandwidth and shorten the latency for network applications running in the co-resident VMs. Evaluations are also presented to prove IDTS’s availability and highly efficiency. We believe that IDTS is an effective solution for the inter-domain communication on Xen virtualization platform.

Cooperative processing is a representative application in pervasive grid and group communication is the key technique in this application. It is a great challenge to ensure the security of group communication in pervasive grid. In this paper, we first describe the service infrastructure of middleware for pervasive grid. Then, we present a secure mechanism of group communication and analyse the correctness and the security of the mechanism. Finally, we verify the validity of this mechanism by experiments. Results show that our proposed mechanism is efficient to ensure the security of group communication in pervasive grid.

Virtual Desktop Environment (VDE) provides a real virtual working environment in which users could personally customize and update the application list from application template libraries. The heterogeneous applications actually running in the remote application servers could cooperatively communicate with each other. It is a thin client approach to mobility in which the perfect combination of VM technology and DFS technology are the keys to the rapid seamless resuming of the usage scenarios. Usage scenarios are incrementally suspended including the user’s documents and the running applications. The usage data stored in data center provides a unified view for the users through historical scenario manager and ensures the data’s security and reliability at the same time. This paper explores the building policy of a real virtual working environment and the suspending/resuming policy of usage scenarios. Experiments demonstrate and evaluate VDE’s efficiency and effectiveness.

In traditional grid, grid user can not validate whether grid service registered in grid platform can execute correctly or not because the system does not provide the measurement mechanism for grid service. In order to solve this problem, we propose a series of strategies and methods for trusted grid. These strategies and methods include: an access control policy for reference database, an integrity attestation for reference datasheet, a construction method of reference datasheet, a trusted storage algorithm of reference datasheet and a report algorithm of reference datasheet. All these constitute the measurement mechanism of service for trusted grid. Some experiments are done in order to validate the feasibility and the availability of this mechanism. The results show that it is feasible and efficient to validate whether grid service registered in trusted grid platform can execute correctly or not.

To reduce tracker's huge stress and dragging peers' long waiting time after requesting the tracker,which are resulted from dragging peers' complete dependency on the tracker in P2P(peer-to-peer)VOD(video-on-demand) system,this paper constructs an overlay.based on time-slip.The main idea of this construction is to equally divide the object program's play-time into several slips,and define each peer's slip according to its playing-time,then make logic relationship between the peers within the same or the different slip by the adjacency of their playing-time.In the topology,the dragging peers reconstruct their logic topology basing on the relationship among peers and adjacency of their playing-time,rather than on the tracker,to eliminate the dependency on the tracker.The simulation result shows that the system's serving performance has an obvious improvement.

In grid computing, group communication is an important strategy to realize large-scale information resource sharing. However, it is very difficult to ensure the security of group communication in large-scale grid environment. In this paper, based on the basic theories of threshold signature and the basic characteristics of group communication in grid, we present four algorithms, including keys generating, individual signature generating and verifying, group signature generating and encrypting, decrypting and group signature verifying, which constitute the authenticated encryption mechanism for group communication in grid. Finally, we validate the correctness of the authenticated encryption mechanism proposed in this paper and analyze its security. In addition, the validity of this mechanism is verified by the experiments. The results show that it is efficient to ensure the security of group communication in grid.

In traditional grid, grid user can not validate whether grid service registered in grid platform can execute correctly or not because the system does not provide the measurement mechanism for grid service. In order to solve this problem, we propose a series of strategies and methods for trusted grid. These strategies and methods include: an access control policy for reference database, an integrity attestation for reference datasheet, a construction method of reference datasheet, a trusted storage algorithm of reference datasheet and a report algorithm of reference datasheet. All these constitute the measurement mechanism of service for trusted grid. Some experiments are done in order to validate the feasibility and the availability of this mechanism. The results show that it is feasible and efficient to validate whether grid service registered in trusted grid platform can execute correctly or not.

Grid computing emerges as an effective technology to couple geographically distributed resources and solve large-scale computational problems in wide area networks. There are several popular grid platforms, such as UNICORE and Globus Toolkit. Many famous grid projects are constructed with these platforms, each of which manages different distributed resources. In order to aggregate resources managed by different grid platforms, it is necessary to implement the interoperation among these grid platforms. Security interoperation is one of key issues for the interoperation. CGSP (ChinaGrid Support Platform) and VEGA are two popular grid platforms in China. To achieve security interoperation between these two platforms, four mapping policies, including user user mapping, user-agora mapping, role-user mapping, role-agora mapping, are proposed in this paper. The security interoperation process is proposed based on SAML specification and the mapping policies. We also analyze the flexibility of mapping policies and the security of the interoperation process.

Collaboration is used for information sharing and activity coordinating, and it exists broadly in many fields. Group communication enables efficient communication between a set of processes logically organized into groups and communicating via multicast in an asynchronous environment. One of the key technologies for collaborative applications is secure group communication. Current research on secure group communication scarcely considers the existing security mechanism in local systems. As a result, group communication systems couldn't provide general support for collaborative applications running on a specific system. Based on the existing grid security technologies, we propose an authentication and access control framework at Virtual Organization (VO) level for group communication in grid environment. By introducing Role-Based Access Control (RBAC) and attribute-based approach, we define group management policies and design group control protocols. The protocols are analyzed from three aspects: compatibility, performance, and security. Finally, we implement a prototype based on GridShib.

With respect to the singleness and blindness of traditional keyword based literature retrieval, built was a relationship-based literature retrieval model, and proposed was a relations hip-based literature retrieval method based on this model. Relationship-based literature retrieval model, which revealed literature entities, explicit and implicit associations between entities, properties of entities, and properties of associations, composed a uniform structure for literature retrieval from global view and could support linkage of isolate information. Relationship-based literature retrieval method could provide comprehensive association information to user s retrieval as well as support user's successive retrieval behavior and crossed retrieval of different entities, so as to enable users to browse literature information that interested them. The evaluation showed the efficiency of the method through comparing with the popular literature retrieval systems-CiteSeer and DBLP.

The P2HP's architecture, which is a computing system with high performance based on peer-to-peer (P2P) networks, is discussed and its two-layer united scheduling algorithm (TLUSA) is proposed. Owing to P2P networks' decentralization and instability, the load-balance, idle computational ability of volunteer and correlative requirement of subtasks was taken into account in TLUSA. The scheduling-loads were decentralized by using this algorithm to avoid scheduling bottleneck, and improves dynamic expansibility and computing efficiency of P2HP. Simulation experiments show that the balance effect and the speedup of the system increase with the rise of volunteers, which verifies the validity of TLUSA.

A novel method for worm detection and control is proposed after the difference between worm and normal connection requests was analyzed. Considering the worm characters of attacking unique port and dispersed IP addresses, the method uses port-based multiple work sets to identify worm connection requests in worm detection process, and employs multiple delay queues to process the suspicious connection requests in worm control process to avoid influence of traffic of different ports. Aiming at the normal connection character of ephemeral bursting out, the method takes advantage of token bucket to control the output of delay queues to shorten the period of staying in the delay queue of normal requests. Tests results show that for infected hosts, the false positive was reduced from 85% to 12% and the average delay time of normal connection requests was shortened from 95.4 seconds to 5.6 seconds by using new methods.

It is still a challenging task to provide large scale video-on-demand (VoD) streaming services based on overlay network due to its inherent dynamicity and heterogeneity. Most of previous work has focused on how to construct a structured overlay to tackle this issue, i.e., tree-based overlay and DHT. However, they always suffer from inefficient resource utilization and poor reliability. In this paper, we propose a new solution based on unstructured overlay, called GridCast, in which a directional gossip protocol and a score-based partner selection algorithm are designed to explore multiple data suppliers for each joined peer. In this way, GridCast can make efficient use of the available upload bandwidth of peers to achieve better scalability and reliability. The experimental results from our early deployment show that it is feasible to provide scalable VoD services based on unstructured overlay.

In this paper, we propose a scalable service scheme for secure group communication in grid. In the service scheme, a series of methods and strategies are presented, such as the initialization methods for group member, administrative domain and virtual organization, the key distribution strategy and the rekeying strategy. In order to improve the scalability of this service scheme, the services for a group are logically divided into two hierarchical levels, which is in accordance with the characteristics of group communication in grid. In addition, in order to show the efficiency and the scalability of the service scheme, simulation experiments are done. The results show that the service scheme is efficient and scalable. Thus, the service scheme can satisfy the requirement of people in large-scale, dynamic grid environment.

In Grid,it is an important strategy that using multicast to realize the large-scale information resource sharing.However,it is very difficult to ensure the security of multicast.In this paper,based on the basic principles of the centralized key distributed strategy and the distributed key distribution strategy,according to the multicast mechanism in Grid,considering the dynamic factors of multicast members,we present the member hierarchy method for key distribution,the member discovery protocol,the clustering protocol and the key distribution strategy,thus constituting the key distribution strategy of security multicast in Grid.In order to validate the feasibility and the availability of this strategy,a simulation experiment is done.The results show that it is feasible and efficient to ensure the security multicast in Grid.

A novel approach, called Aeneas, which is based on the execution state of distributed programs, is proposed in this paper. It is for the real-time performance analysis of distributed programs with reliability-constrains. In Aeneas, there are two important factors, the available data files and the transmission paths of each available data file. Some algorithms are designed to find all the transmission paths of each data file needed while the program executes, count the transmission time for each transmission path, then get the aggregate expression of transmission time, calculate the fastest response time and the slowest response time of distributed programs with reliability-constrains. In order to justify the feasibility and the availability of this approach, a series of experiments have been done. The results show that it is feasible and efficient to evaluate the real-time performance for distributed software with reliability-constrains.

Group communication is one of the most important strategies to realize large-scale information resource sharing in grid. However, it is very difficult to ensure the security of group communication in grid. In this paper, we propose a digital signature mechanism with one time secret key. In the mechanism, the trust center only needs to issue the partial secret key one time for each group member; and each group member can generate its different secret key each time. Moreover, the size of the signature is independent of the number of group members and the group public key is constant. According to this mechanism, we present a new authentication scheme. In order to verify the efficiency of the scheme, a series of simulation experiments are presented. The results show that the scheme is efficient for group communication in grid.

For the periodic real-time task sets on uniprocessor systems, FT/FA (fault-tolerance/frequency assurance) scheduling of imprecise computation was proposed. The mandatory parts in the tasks can tolerate fault and the timing constraints of the tasks can be satisfied even if any fault occurs. The executing frequencies of the optional parts in the tasks can be assured so that the executed tasks are superior in quality. The conditions of scheduling for FT/FA approaches were given. The performance of this approach was also analyzed by the simulation tests.