@conference {14736,
	title = {State transfer for clear and efficient runtime updates},
	booktitle = {2011 IEEE 27th International Conference on Data Engineering Workshops (ICDEW)},
	year = {2011},
	month = {2011/04/11/16},
	pages = {179 - 184},
	publisher = {IEEE},
	organization = {IEEE},
	abstract = {Dynamic software updating (DSU), the practice of updating software while it executes, is a lively area of research. The DSU approach most prominent in both commercial and research systems is in-place updating, in which patches containing program modifications are loaded into a running process. However, in-place updating suffers from several problems: it requires complex tool support, it may adversely affect the performance of normal execution, it requires challenging reasoning to understand the behavior of an updated program, and it requires extra effort to modify program state to be compatible with an update. This paper presents preliminary work investigating the potential for state transfer updating to address these problems. State transfer updates work by launching a new process running the updated program version and transferring program state from the running process to the updated version. In this paper, we describe the use and implementation of Ekiden, a new state transfer updating library for C/C++ programs. Ekiden seeks to redress the difficulties of in-place updating, and we report on our experience updating VSFTPD using Ekiden. This initial experience suggests that state transfer provides the availability benefits of in-place DSU approaches while addressing many of their shortcomings.},
	keywords = {C++ language, C++ program, Cognition, complex tool support, dynamic software updating, efficient runtime update, in-place DSU approach, Libraries, Operating systems, program modification, Program processors, program transfer, program version, Runtime, servers, software libraries, Software maintenance, state transfer update, Steady-state, updating library, VSFTPD},
	isbn = {978-1-4244-9195-7},
	doi = {10.1109/ICDEW.2011.5767632},
	author = {Hayden,C.M. and Smith,E. K and Hicks, Michael W. and Foster, Jeffrey S.}
}
@inbook {19491,
	title = {Ecotopia: An Ecological Framework for Change Management in Distributed Systems},
	booktitle = {Architecting Dependable Systems IV},
	series = {Lecture Notes in Computer Science},
	year = {2007},
	month = {2007/01/01/},
	pages = {262 - 286},
	publisher = {Springer Berlin Heidelberg},
	organization = {Springer Berlin Heidelberg},
	abstract = {Dynamic change management in an autonomic, service-oriented infrastructure is likely to disrupt the critical services delivered by the infrastructure. Furthermore, change management must accommodate complex real-world systems, where dependability and performance objectives are managed across multiple distributed service components and have specific criticality/value models. In this paper, we present Ecotopia, a framework for change management in complex service-oriented architectures (SOA) that is ecological in its intent: it schedules change operations with the goal of minimizing the service-delivery disruptions by accounting for their impact on the SOA environment. The change-planning functionality of Ecotopia is split between multiple objective-advisors and a system-level change-orchestrator component. The objective advisors assess the change-impact on service delivery by estimating the expected values of the Key Performance Indicators (KPIs), during and after change. The orchestrator uses the KPI estimations to assess the per-objective and overall business-value changes over a long time-horizon and to identify the scheduling plan that maximizes the overall business value. Ecotopia handles both external change requests, like software upgrades, and internal changes requests, like fault-recovery actions. We evaluate the Ecotopia framework using two realistic change-management scenarios in distributed enterprise systems.},
	keywords = {Autonomic Computing, Dynamic Change Management, Fault-Tolerant Architecture, Operating systems, Performability, Service Orchestration, software engineering},
	isbn = {978-3-540-74033-9, 978-3-540-74035-3},
	url = {http://link.springer.com/chapter/10.1007/978-3-540-74035-3_12},
	author = {Tudor Dumitras and Ro{\c s}u, Daniela and Dan, Asit and Narasimhan, Priya},
	editor = {Lemos, Rog{\'e}rio de and Gacek, Cristina and Romanovsky, Alexander}
}
@conference {14706,
	title = {Managing policy updates in security-typed languages},
	booktitle = {19th IEEE Computer Security Foundations Workshop, 2006},
	year = {2006},
	month = {2006///},
	pages = {13 pp.-216 - 13 pp.-216},
	publisher = {IEEE},
	organization = {IEEE},
	abstract = {This paper presents Rx, a new security-typed programming language with features intended to make the management of information-flow policies more practical. Security labels in Rx, in contrast to prior approaches, are defined in terms of owned roles, as found in the RT role-based trust-management framework. Role-based security policies allow flexible delegation, and our language Rx provides constructs through which programs can robustly update policies and react to policy updates dynamically. Our dynamic semantics use statically verified transactions to eliminate illegal information flows across updates, which we call transitive flows. Because policy updates can be observed through dynamic queries, policy updates can potentially reveal sensitive information. As such, Rx considers policy statements themselves to be potentially confidential information and subject to information-flow metapolicies},
	keywords = {Access control, Computer languages, Data security, Database systems, dynamic queries, dynamic semantics, Educational institutions, high level languages, Information security, information-flow policy management, Lattices, Network servers, Operating systems, policy update management, Robustness, role-based security policies, RT role-based trust-management framework, Rx security-typed programming language, security of data, statically verified transactions, transitive flows},
	isbn = {0-7695-2615-2},
	doi = {10.1109/CSFW.2006.17},
	author = {Swamy,N. and Hicks, Michael W. and Tse,S. and Zdancewic,S.}
}
@inbook {19486,
	title = {Architecting and Implementing Versatile Dependability},
	booktitle = {Architecting Dependable Systems III},
	series = {Lecture Notes in Computer Science},
	year = {2005},
	month = {2005/01/01/},
	pages = {212 - 231},
	publisher = {Springer Berlin Heidelberg},
	organization = {Springer Berlin Heidelberg},
	abstract = {Distributed applications must often consider and select the appropriate trade-offs among three important aspects {\textendash} fault-tolerance, performance and resources. We introduce a novel concept, called versatile dependability, that provides a framework for analyzing and reasoning about these trade-offs in dependable software architectures. We present the architecture of a middleware framework that implements versatile dependability by providing the appropriate {\textquotedblright}knobs{\textquotedblright} to tune and re-calibrate the trade-offs. Our framework can adjust the properties and the behavior of the system at development-time, at deployment-time, and throughout the application{\textquoteright}s life-cycle. This renders the versatile dependability approach useful both to applications that require static fault-tolerance configurations supporting the loss/addition of resources and changing workloads, as well as to applications that evolve in terms of their dependability requirements. Through a couple of specific examples, one on adapting the replication style at runtime and the other on tuning the system scalability under given constraints, we demonstrate concretely how versatile dependability can provide an extended coverage of the design space of dependable distributed systems.},
	keywords = {Operating systems, software engineering},
	isbn = {978-3-540-28968-5, 978-3-540-31648-0},
	url = {http://link.springer.com/chapter/10.1007/11556169_10},
	author = {Tudor Dumitras and Srivastava, Deepti and Narasimhan, Priya},
	editor = {Lemos, Rog{\'e}rio de and Gacek, Cristina and Romanovsky, Alexander}
}
@inbook {19494,
	title = {Fault-Tolerant Middleware and the Magical 1\%},
	booktitle = {Middleware 2005},
	series = {Lecture Notes in Computer Science},
	year = {2005},
	month = {2005/01/01/},
	pages = {431 - 441},
	publisher = {Springer Berlin Heidelberg},
	organization = {Springer Berlin Heidelberg},
	abstract = {Through an extensive experimental analysis of over 900 possible configurations of a fault-tolerant middleware system, we present empirical evidence that the unpredictability inherent in such systems arises from merely 1\% of the remote invocations. The occurrence of very high latencies cannot be regulated through parameters such as the number of clients, the replication style and degree or the request rates. However, by selectively filtering out a {\textquotedblleft}magical 1\%{\textquotedblright} of the raw observations of various metrics, we show that performance, in terms of measured end-to-end latency and throughput, can be bounded, easy to understand and control. This simple statistical technique enables us to guarantee, with some level of confidence, bounds for percentile-based quality of service (QoS) metrics, which dramatically increase our ability to tune and control a middleware system in a predictable manner.},
	keywords = {Computer Communication Networks, Information Systems Applications (incl.Internet), Operating systems, Programming Languages, Compilers, Interpreters, Programming Techniques, software engineering},
	isbn = {978-3-540-30323-7, 978-3-540-32269-6},
	url = {http://link.springer.com/chapter/10.1007/11587552_24},
	author = {Tudor Dumitras and Narasimhan, Priya},
	editor = {Alonso, Gustavo}
}
@conference {12295,
	title = {Running on the bare metal with GeekOS},
	booktitle = {Proceedings of the 35th SIGCSE technical symposium on Computer science education},
	series = {SIGCSE {\textquoteright}04},
	year = {2004},
	month = {2004///},
	pages = {315 - 319},
	publisher = {ACM},
	organization = {ACM},
	address = {New York, NY, USA},
	abstract = {Undergraduate operating systems courses are generally taught using one of two approaches: abstract or concrete. In the abstract approach, students learn the concepts underlying operating systems theory, and perhaps apply them using user-level threads in a host operating system. In the concrete approach, students apply concepts by working on a real operating system kernel. In the purest manifestation of the concrete approach, students implement operating system projects that run on real hardware.GeekOS is an instructional operating system kernel which runs on real hardware. It provides the minimum functionality needed to schedule threads and control essential devices on an x86 PC. On this foundation, we have developed projects in which students build processes, semaphores, a multilevel feedback scheduler, paged virtual memory, a filesystem, and inter-process communication. We use the Bochs emulator for ease of development and debugging. While this approach (tiny kernel run on an emulator) is not new, we believe GeekOS goes further towards the goal of combining realism and simplicity than previous systems have.},
	keywords = {education, emulation, Hardware, Operating systems},
	isbn = {1-58113-798-2},
	doi = {10.1145/971300.971411},
	url = {http://doi.acm.org/10.1145/971300.971411},
	author = {Hovemeyer, David and Hollingsworth, Jeffrey K and Bhattacharjee, Bobby}
}
@article {12103,
	title = {Security for virtual private intranets},
	journal = {Computer},
	volume = {31},
	year = {1998},
	month = {1998/09//},
	pages = {48 - 55},
	abstract = {As telecommuting grows, businesses must consider security when extending their network environment to employees{\textquoteright} homes. Researchers at the University of Pennsylvania have addressed the problem with smart cards, operating system modifications, and network authentication. We note the distinction between trust and integrity: trust is determined through the verification of components and the dependencies among them, while integrity demonstrates that components haven{\textquoteright}t been modified. Thus integrity checking in a trustworthy system is about preserving an established trust or trust relationship. Our solution to the challenge of isolating functional roles that may share a single hardware platform is called secure identity based lending (SIBL). SIBL provides multiple personalities by partitioning the hard drive into n+1 partitions, where n is the number of supported personalities. All personalities use the system partition for core operating system components and shared applications. Each of the personalities is also associated with one of the remaining partitions, which are encrypted using a symmetric algorithm},
	keywords = {businesses, Clouds, Companies, core operating system components, cryptography, Data security, employee homes, encryption, functional roles, hard drive, Home computing, home working, integrity checking, Internet, Local area networks, multiple personalities, network authentication, network environment, operating system modifications, Operating systems, Roads, secure identity based lending, security management, security of data, shared applications, SIBL, single hardware platform, smart cards, symmetric algorithm, system partition, telecommuting, Teleworking, trust relationship, trustworthy system, virtual private intranets},
	isbn = {0018-9162},
	doi = {10.1109/2.708450},
	author = {Arbaugh, William A. and Davin,J. R and Farber,D. J and Smith,J. M}
}
@conference {14813,
	title = {MDL: a language and compiler for dynamic program instrumentation},
	booktitle = {, 1997 International Conference on Parallel Architectures and Compilation Techniques., 1997. Proceedings},
	year = {1997},
	month = {1997/11/10/14},
	pages = {201 - 212},
	publisher = {IEEE},
	organization = {IEEE},
	abstract = {We use a form of dynamic code generation, called dynamic instrumentation, to collect data about the execution of an application program. Dynamic instrumentation allows us to instrument running programs to collect performance and other types of information. The instrumentation code is generated incrementally and can be inserted and removed at any time. Our instrumentation currently runs on the SPARC, PA-RISC, Power 2, Alpha, and x86 architectures. Specification of what data to collect are written in a specialized language called the Metric Description Language, that is part of the Paradyn Parallel Performance Tools. This language allows platform independent descriptions of how to collect performance data. It also provides a concise way to specify, how to constrain performance data to particular resources such as modules, procedures, nodes, files, or message channels (or combinations of these resources). We also describe the details of how we weave instrumentation into a running program},
	keywords = {Alpha architecture, application program, application program interfaces, Application software, compiler generators, Computer science, dynamic code generation, Dynamic compiler, dynamic program instrumentation, Educational institutions, files, instrumentation code, Instruments, MDL, measurement, message channels, Message passing, Metric Description Language, modules, nodes, Operating systems, optimising compilers, PA-RISC, Paradyn Parallel Performance Tools, Parallel architectures, parallel programming, performance data, platform independent descriptions, Power 2 architecture, Power generation, procedures, program debugging, Program processors, running programs, Runtime, software metrics, SPARC, Specification languages, x86 architecture},
	isbn = {0-8186-8090-3},
	doi = {10.1109/PACT.1997.644016},
	author = {Hollingsworth, Jeffrey K and Niam, O. and Miller, B. P and Zhichen Xu and Goncalves,M. J.R and Ling Zheng}
}
@conference {12092,
	title = {A secure and reliable bootstrap architecture},
	booktitle = {, 1997 IEEE Symposium on Security and Privacy, 1997. Proceedings},
	year = {1997},
	month = {1997/05/04/7},
	pages = {65 - 71},
	publisher = {IEEE},
	organization = {IEEE},
	abstract = {In a computer system, the integrity of lower layers is typically treated as axiomatic by higher layers. Under the presumption that the hardware comprising the machine (the lowest layer) is valid, the integrity of a layer can be guaranteed if and only if: (1) the integrity of the lower layers is checked and (2) transitions to higher layers occur only after integrity checks on them are complete. The resulting integrity {\textquotedblleft}chain{\textquotedblright} inductively guarantees system integrity. When these conditions are not met, as they typically are not in the bootstrapping (initialization) of a computer system, no integrity guarantees can be made, yet these guarantees are increasingly important to diverse applications such as Internet commerce, security systems and {\textquotedblleft}active networks{\textquotedblright}. In this paper, we describe the AEGIS architecture for initializing a computer system. It validates integrity at each layer transition in the bootstrap process. AEGIS also includes a recovery process for integrity check failures, and we show how this results in robust systems},
	keywords = {active networks, AEGIS architecture, bootstrap architecture, Computer architecture, computer bootstrapping, data integrity, Distributed computing, Hardware, hardware validity, initialization, integrity chain, integrity check failures, Internet, Internet commerce, IP networks, Laboratories, lower-layer integrity, Microprogramming, Operating systems, recovery process, reliability, robust systems, Robustness, Security, security of data, software reliability, system integrity guarantees, system recovery, transitions, Virtual machining},
	isbn = {0-8186-7828-3},
	doi = {10.1109/SECPRI.1997.601317},
	author = {Arbaugh, William A. and Farber,D. J and Smith,J. M}
}
@conference {14760,
	title = {Dynamic program instrumentation for scalable performance tools},
	booktitle = {Scalable High-Performance Computing Conference, 1994., Proceedings of the},
	year = {1994},
	month = {1994/05//},
	pages = {841 - 850},
	publisher = {IEEE},
	organization = {IEEE},
	abstract = {Presents a new technique called {\textquoteleft}dynamic instrumentation{\textquoteright} that provides efficient, scalable, yet detailed data collection for large-scale parallel applications. Our approach is unique because it defers inserting any instrumentation until the application is in execution. We can insert or change instrumentation at any time during execution by modifying the application{\textquoteright}s binary image. Only the instrumentation required for the currently selected analysis or visualization is inserted. As a result, our technique collects several orders of magnitude less data than traditional data collection approaches. We have implemented a prototype of our dynamic instrumentation on the CM-5, and present results for several real applications. In addition, we include recommendations to operating system designers, compiler writers, and computer architects about the features necessary to permit efficient monitoring of large-scale parallel systems},
	keywords = {Application software, binary image, compiler writing, Computer architecture, Computer displays, Computerized monitoring, Concurrent computing, data acquisition, data collection, data visualisation, Data visualization, dynamic program instrumentation, efficient monitoring, executing program, Instruments, large-scale parallel applications, Large-scale systems, operating system design, Operating systems, parallel programming, program analysis, program diagnostics, program visualization, Programming profession, Sampling methods, scalable performance tools, software tools},
	isbn = {0-8186-5680-8},
	doi = {10.1109/SHPCC.1994.296728},
	author = {Hollingsworth, Jeffrey K and Miller, B. P and Cargille, J.}
}
@article {14791,
	title = {IPS-2: the second generation of a parallel program measurement system},
	journal = {IEEE Transactions on Parallel and Distributed Systems},
	volume = {1},
	year = {1990},
	month = {1990/04//},
	pages = {206 - 217},
	abstract = {IPS, a performance measurement system for parallel and distributed programs, is currently running on its second implementation. IPS{\textquoteright}s model of parallel programs uses knowledge about the semantics of a program{\textquoteright}s structure to provide two important features. First, IPS provides a large amount of performance data about the execution of a parallel program, and this information is organized so that access to it is easy and intuitive. Secondly, IPS provides performance analysis techniques that help to guide the programmer automatically to the location of program bottlenecks. The first implementation of IPS was a testbed for the basic design concepts, providing experience with a hierarchical program and measurement model, interactive program analysis, and automatic guidance techniques. It was built on the Charlotte distributed operating system. The second implementation, IPS-2, extends the basic system with new instrumentation techniques, an interactive and graphical user interface, and new automatic guidance analysis techniques. This implementation runs on 4.3BSD UNIX systems, on the VAX, DECstation, Sun 4, and Sequent Symmetry multiprocessor},
	keywords = {4.3BSD UNIX systems, automatic guidance techniques, Automatic testing, Charlotte distributed operating system, CPA, DECstation, design concepts, distributed programs, graphical user interface, Graphical user interfaces, Instruments, interactive program analysis, IPS-2, measurement, message systems, network operating systems, Operating systems, parallel program measurement system, parallel programming, parallel programs, Performance analysis, performance analysis techniques, performance evaluation, performance measurement system, Power system modeling, program bottlenecks, program diagnostics, Programming profession, semantics, Sequent Symmetry multiprocessor, shared-memory systems, software tools, Springs, Sun, Sun 4, Unix, VAX},
	isbn = {1045-9219},
	doi = {10.1109/71.80132},
	author = {Miller, B. P and Clark, M. and Hollingsworth, Jeffrey K and Kierstead, S. and Lim,S. -S and Torzewski, T.}
}
