The Experts below are selected from a list of 66 Experts worldwide ranked by ideXlab platform
Bettina Kemme - One of the best experts on this subject based on the ideXlab platform.
-
Euro-Par - A Unified Framework for Load Distribution and Fault-Tolerance of Application Servers
Lecture Notes in Computer Science, 2009Co-Authors: Bettina KemmeAbstract:This paper proposes a novel replication architecture for Stateful Application servers that offers an integrated solution for fault-tolerance and load-distribution. Each Application server replica is able to execute client requests and at the same time serves as backup for other replicas. We propose an effective load balancing mechanism that is only load-aware if a server is close to become overloaded. Furthermore, we present transparent reconfiguration algorithms that guarantee that each replica has the same number of backups in a dynamic environment where replicas can join or leave at any time. Our evaluation shows that our approach scales and distributes load across all servers even in heterogeneous environments while keeping the overhead for fault-tolerance and load-balancing small.
-
fault tolerance for Stateful Application servers in the presence of advanced transactions patterns
Symposium on Reliable Distributed Systems, 2005Co-Authors: Bettina KemmeAbstract:Replication is widely used in Application server products to tolerate faults. An important challenge is to correctly coordinate replication and transaction execution for Stateful Application servers. Many current solutions assume that a single client request generates exactly one transaction at the server. However, it is quite common that several client requests are encapsulated within one server transaction or that a single client request can initiate several server transactions. In this paper, we propose a replication tool that is able to handle these variations in request/transaction association. We have integrated our approach into the J2EE Application server JBoss. Our evaluation using the ECPerf benchmark shows a low overhead of the approach.
-
SRDS - Fault-tolerance for Stateful Application servers in the presence of advanced transactions patterns
24th IEEE Symposium on Reliable Distributed Systems (SRDS'05), 1Co-Authors: Bettina KemmeAbstract:Replication is widely used in Application server products to tolerate faults. An important challenge is to correctly coordinate replication and transaction execution for Stateful Application servers. Many current solutions assume that a single client request generates exactly one transaction at the server. However, it is quite common that several client requests are encapsulated within one server transaction or that a single client request can initiate several server transactions. In this paper, we propose a replication tool that is able to handle these variations in request/transaction association. We have integrated our approach into the J2EE Application server JBoss. Our evaluation using the ECPerf benchmark shows a low overhead of the approach.
Thomas W. Shinder - One of the best experts on this subject based on the ideXlab platform.
-
ISA 2006 Stateful Inspection and Application Layer Filtering
The Best Damn Firewall Book Period, 2007Co-Authors: Thomas W. ShinderAbstract:The ISA firewall is able to perform Stateful Application layer inspection, which enables it to fully inspect the communication streams passed by it from one network to another. In contrast to Stateful filtering where only the network and transport layer information is filtered, true Stateful inspection requires that the firewall be able to analyze and make decisions on all layers of the communication, including the most important layer, the Application layer. The Web filters perform Stateful Application layer inspection on communications handled by the ISA firewall's Web Proxy components. The Web Proxy handles connections for HTTP, HTTPS (SSL), and HTTP tunneled FTP connections. This chapter discusses the ISA firewall's Application layer filtering feature set. It discusses the two main types of Application filters employed by the ISA firewall—access filters and security filters. Both the access filters and the security filters impose requirements that the connections meet specifications of legitimate communications using those protocols. Finally, the chapterdiscusses the ISA firewall's intrusion detection and prevention mechanisms. Common network layer attacks that can be launched against the ISA firewall and how the ISA firewall protects you against them are covered in this chapter.
-
Chapter 4 – Creating and Using ISA 2006 Firewall Access Policy
Dr. Tom Shinder's ISA Server 2006 Migration Guide, 2007Co-Authors: Thomas W. ShinderAbstract:Publisher Summary This chapter discusses creation and use of ISA 2006 Firewall access policy. One of the major improvements in the new ISA firewall over ISA Server 2000 is the ability to create all Policy Elements on the fly. It is found that in addition to the built-in protocols, you can create your own protocols by using the ISA firewall's New Protocol Wizard. The predefined user set represents all authenticated users, regardless of the method used to authenticate. This prebuilt User Set represents the Local System service, and the Network service on the ISA firewall machine itself. This User Set is used in some System Policy Rules. Access Rules always apply to outbound connections. It is observed that when an Access Rule is created that allows outbound Remote Procedure Call (RPC), there is an option to configure RPC protocol policy. The Access Rules that allow All Internet Protocol (IP) Traffic also include RPC protocols. It is found that the ISA firewall's Stateful Application inspection mechanism allows you to control access not just to ports, but to the actual protocols moving through those ports.
-
ISA 2004 Stateful Inspection and Application Layer Filtering
How to Cheat at Configuring ISA Server 2004, 2006Co-Authors: Thomas W. ShinderAbstract:The chapter discusses the ISA firewall's Application layer filtering feature set. It focuses on the two main types of Application filters employed by the ISA firewall: access filters and security filters. Both access filters and security filters impose requirements that the connections meet specifications of legitimate communications using those protocols. The ISA firewall is able to perform both Stateful filtering and Stateful Application layer inspection. The ISA firewall's Stateful filtering feature set makes the ISA firewall a network layer Stateful firewall in the same class as any hardware firewall that performs Stateful filtering at the network and transport layers. Stateful filtering is often referred to as Stateful packet inspection. The chapter also discusses the ISA firewall's intrusion detection and prevention mechanisms.
Krishnashree Achuthan - One of the best experts on this subject based on the ideXlab platform.
-
SSCC - Managing Network Functions in Stateful Application Aware SDN
Communications in Computer and Information Science, 2019Co-Authors: Prabhakar Krishnan, Krishnashree AchuthanAbstract:Software-defined networking (SDN) is emerging as a paradigm shift, drastically changing the modern networking, as it simplifies and automates the orchestration, administration of large Applications and data centers. SDN architecture offers an easy programmable interface, centralized control and distributed state management model for modern networks. However, in classical implementation of SDN, the intelligence is centralized at the controller and the role of the switches is reduced to perform simple forwarding of packets. Thus, it is obvious that the controller, in addition to control and management operations, it must gather the runtime state and information from switches all over the network. This essentially poses some huge risks: (a) controller overload, (b) congestion in the control channel because of the dependence of switches on controller for even rudimentary forwarding operations (c) making the entire network infrastructure itself vulnerable and (d) eventually leading to resource saturation attacks on the servers in the network. As SDN opened up such new attack vectors, several solutions were proposed in terms of control plane extensions, data plane innovations, improved programming abstractions, augmenting OpenFlow channel. In this paper, we present our observations on emerging Stateful SDN architectures and propose a Stateful/Application-aware SDN architecture. We developed a security-aware framework to detect threats and mitigate saturation attacks in SDN stack and to defend Denial-of-Services (DoS) attacks on other network services and present our experiments with DoS/Flooding attack tools, datasets from popular sources, simulation of real-world attack scenarios on transport protocols TCP, UDP/IP and HTTP, NTP services. The attack detection mechanism has no significant performance impact to good traffic and average detection confidence over 99.99% of traffic states, the mitigation response is comparable with the state of the art, but with our extensible secure architecture we can defend future attacks at scale.
-
Managing Network Functions in Stateful Application Aware SDN
Security in Computing and Communications, 2019Co-Authors: Prabhakar Krishnan, Krishnashree AchuthanAbstract:Software-defined networking (SDN) is emerging as a paradigm shift, drastically changing the modern networking, as it simplifies and automates the orchestration, administration of large Applications and data centers. SDN architecture offers an easy programmable interface, centralized control and distributed state management model for modern networks. However, in classical implementation of SDN, the intelligence is centralized at the controller and the role of the switches is reduced to perform simple forwarding of packets. Thus, it is obvious that the controller, in addition to control and management operations, it must gather the runtime state and information from switches all over the network. This essentially poses some huge risks: (a) controller overload, (b) congestion in the control channel because of the dependence of switches on controller for even rudimentary forwarding operations (c) making the entire network infrastructure itself vulnerable and (d) eventually leading to resource saturation attacks on the servers in the network. As SDN opened up such new attack vectors, several solutions were proposed in terms of control plane extensions, data plane innovations, improved programming abstractions, augmenting OpenFlow channel. In this paper, we present our observations on emerging Stateful SDN architectures and propose a Stateful/Application-aware SDN architecture. We developed a security-aware framework to detect threats and mitigate saturation attacks in SDN stack and to defend Denial-of-Services (DoS) attacks on other network services and present our experiments with DoS/Flooding attack tools, datasets from popular sources, simulation of real-world attack scenarios on transport protocols TCP, UDP/IP and HTTP, NTP services. The attack detection mechanism has no significant performance impact to good traffic and average detection confidence over 99.99% of traffic states, the mitigation response is comparable with the state of the art, but with our extensible secure architecture we can defend future attacks at scale.
Prabhakar Krishnan - One of the best experts on this subject based on the ideXlab platform.
-
SSCC - Managing Network Functions in Stateful Application Aware SDN
Communications in Computer and Information Science, 2019Co-Authors: Prabhakar Krishnan, Krishnashree AchuthanAbstract:Software-defined networking (SDN) is emerging as a paradigm shift, drastically changing the modern networking, as it simplifies and automates the orchestration, administration of large Applications and data centers. SDN architecture offers an easy programmable interface, centralized control and distributed state management model for modern networks. However, in classical implementation of SDN, the intelligence is centralized at the controller and the role of the switches is reduced to perform simple forwarding of packets. Thus, it is obvious that the controller, in addition to control and management operations, it must gather the runtime state and information from switches all over the network. This essentially poses some huge risks: (a) controller overload, (b) congestion in the control channel because of the dependence of switches on controller for even rudimentary forwarding operations (c) making the entire network infrastructure itself vulnerable and (d) eventually leading to resource saturation attacks on the servers in the network. As SDN opened up such new attack vectors, several solutions were proposed in terms of control plane extensions, data plane innovations, improved programming abstractions, augmenting OpenFlow channel. In this paper, we present our observations on emerging Stateful SDN architectures and propose a Stateful/Application-aware SDN architecture. We developed a security-aware framework to detect threats and mitigate saturation attacks in SDN stack and to defend Denial-of-Services (DoS) attacks on other network services and present our experiments with DoS/Flooding attack tools, datasets from popular sources, simulation of real-world attack scenarios on transport protocols TCP, UDP/IP and HTTP, NTP services. The attack detection mechanism has no significant performance impact to good traffic and average detection confidence over 99.99% of traffic states, the mitigation response is comparable with the state of the art, but with our extensible secure architecture we can defend future attacks at scale.
-
Managing Network Functions in Stateful Application Aware SDN
Security in Computing and Communications, 2019Co-Authors: Prabhakar Krishnan, Krishnashree AchuthanAbstract:Software-defined networking (SDN) is emerging as a paradigm shift, drastically changing the modern networking, as it simplifies and automates the orchestration, administration of large Applications and data centers. SDN architecture offers an easy programmable interface, centralized control and distributed state management model for modern networks. However, in classical implementation of SDN, the intelligence is centralized at the controller and the role of the switches is reduced to perform simple forwarding of packets. Thus, it is obvious that the controller, in addition to control and management operations, it must gather the runtime state and information from switches all over the network. This essentially poses some huge risks: (a) controller overload, (b) congestion in the control channel because of the dependence of switches on controller for even rudimentary forwarding operations (c) making the entire network infrastructure itself vulnerable and (d) eventually leading to resource saturation attacks on the servers in the network. As SDN opened up such new attack vectors, several solutions were proposed in terms of control plane extensions, data plane innovations, improved programming abstractions, augmenting OpenFlow channel. In this paper, we present our observations on emerging Stateful SDN architectures and propose a Stateful/Application-aware SDN architecture. We developed a security-aware framework to detect threats and mitigate saturation attacks in SDN stack and to defend Denial-of-Services (DoS) attacks on other network services and present our experiments with DoS/Flooding attack tools, datasets from popular sources, simulation of real-world attack scenarios on transport protocols TCP, UDP/IP and HTTP, NTP services. The attack detection mechanism has no significant performance impact to good traffic and average detection confidence over 99.99% of traffic states, the mitigation response is comparable with the state of the art, but with our extensible secure architecture we can defend future attacks at scale.
Henry Qin - One of the best experts on this subject based on the ideXlab platform.
-
HotOS - Fast key-value stores: An idea whose time has come and gone
Proceedings of the Workshop on Hot Topics in Operating Systems, 2019Co-Authors: Atul Adya, Robert Grandl, Daniel S. Myers, Henry QinAbstract:Remote, in-memory key-value (RINK) stores such as Memcached [6] and Redis [7] are widely used in industry and are an active area of academic research. Coupled with stateless Application servers to execute business logic and a databaselike system to provide persistent storage, they form a core component of popular data center service architectures. We argue that the time of the RINK store has come and gone: their domain-independent APIs (e.g., PUT/GET) push complexity back to the Application, leading to extra (un)marshalling overheads and network hops. Instead, data center services should be built using Stateful Application servers or custom in-memory stores with domain-specific APIs, which offer higher performance than RINKS at lower cost. Such designs have been avoided because they are challenging to implement without appropriate infrastructure support. Given recent advances in auto-sharding [8, 9], we argue it is time to revisit these decisions. In this paper, we evaluate the potential performance improvements of Stateful designs, propose a new abstraction, the linked, in-memory key-value (LINK) store, to enable developers to easily implement Stateful services, and discuss areas for future research.