Latency Overhead Research Articles

Two-Stage Estimation and Variance Modeling for Latency-Constrained Variational Quantum Algorithms

The quantum approximate optimization algorithm (QAOA) has enjoyed increasing attention in noisy, intermediate-scale quantum computing with its application to combinatorial optimization problems. QAOA has the potential to demonstrate a quantum advantage for NP-hard combinatorial optimization problems. As a hybrid quantum-classical algorithm, the classical component of QAOA resembles a simulation optimization problem in which the simulation outcomes are attainable only through a quantum computer. The simulation that derives from QAOA exhibits two unique features that can have a substantial impact on the optimization process: (i) the variance of the stochastic objective values typically decreases in proportion to the optimality gap, and (ii) querying samples from a quantum computer introduces an additional latency overhead. In this paper, we introduce a novel stochastic trust-region method derived from a derivative-free, adaptive sampling trust-region optimization method intended to efficiently solve the classical optimization problem in QAOA by explicitly taking into account the two mentioned characteristics. The key idea behind the proposed algorithm involves constructing two separate local models in each iteration: a model of the objective function and a model of the variance of the objective function. Exploiting the variance model allows us to restrict the number of communications with the quantum computer and also helps navigate the nonconvex objective landscapes typical in QAOA optimization problems. We numerically demonstrate the superiority of our proposed algorithm using the SimOpt library and Qiskit when we consider a metric of computational burden that explicitly accounts for communication costs. History: Accepted by Giacomo Nannicini, Area Editor for Quantum Computing and Operations Research. Accepted for Special Issue. Funding: This material is based upon work supported by the U.S. Department of Energy, Office of Science, National Quantum Information Science Research Centers and the Office of Advanced Scientific Computing Research, Accelerated Research for Quantum Computing program under contract number DE-AC02-06CH11357. Y. Ha and S. Shashaani also gratefully acknowledge the U.S. National Science Foundation Division of Civil, Mechanical and Manufacturing Innovation Grant CMMI-2226347 and the U.S. Office of Naval Research [Grant N000142412398]. Supplemental Material: The software that supports the findings of this study is available within the paper and its Supplemental Information ( https://pubsonline.informs.org/doi/suppl/10.1287/ijoc.2024.0575 ) as well as from the IJOC GitHub software repository ( https://github.com/INFORMSJoC/2024.0575 ). The complete IJOC Software and Data Repository is available at https://informsjoc.github.io/ .

A Two-Phase Deep Learning Approach to Link Quality Estimation for Multiple-Beam Transmission

In the multi-user multiple-input-multiple-output (MU-MIMO) beamforming (BF) training defined by the 802.11ay standard, since a single initiator transmits a significant number of action frames to multiple responders, inefficient configuration of the transmit antenna arrays when sending these action frames increases the signaling and latency overheads of MU-MIMO BF training. To configure appropriate transmit antenna arrays for transmitting action frames, the initiator needs to accurately estimate the signal to noise ratios (SNRs) measured at the responders for each configuration of the transmit antenna arrays. In this paper, we propose a two-phase deep learning approach to improve the accuracy of SNR estimation for multiple concurrent beams by reducing the measurement errors of the SNRs for individual single beams when each action frame is transmitted through multiple concurrent beams. Through simulations, we demonstrated that our proposed scheme enabled more responders to successfully receive action frames during MU-MIMO BF training compared to existing schemes.

ApSpGEMM: Accelerating Large-scale SpGEMM with Heterogeneous Collaboration and Adaptive Panel

The Sparse General Matrix-Matrix multiplication (SpGEMM) is a fundamental component for many applications, such as algebraic multigrid methods (AMG), graphic processing, and deep learning. However, the unbearable latency of computing high-dimensional, large-scale sparse matrix multiplication on GPUs hinders the development of these applications. An effective approach is heterogeneous cores collaborative computing, but this method must address three aspects: (1) irregular non-zero elements lead to load imbalance and irregular memory access, (2) different core computing latency differences reduce computational parallelism, and (3) temporary data transfer between different cores introduces additional latency overhead. In this work, we propose an innovative framework for collaborative large-scale sparse matrix multiplication on CPU-GPU heterogeneous cores, named ApSpGEMM. ApSpGEMM is based on sparsity rules and proposes reordering and splitting algorithms to eliminate the impact of non-zero element distribution features on load and memory access. Then adaptive panels allocation with affinity constraints among cores improves computational parallelism. Finally, carefully arranged asynchronous data transmission and computation balance communication overhead. Compared with state-of-the-art SpGEMM methods, our approach provides excellent absolute performance on matrices with different sparse structures. On heterogeneous cores, the GFlops of large-scale sparse matrix multiplication is improved by 2.25 to 7.21 times.

Scalable watermarking for identifying large language model outputs

Large language models (LLMs) have enabled the generation of high-quality synthetic text, often indistinguishable from human-written content, at a scale that can markedly affect the nature of the information ecosystem1–3. Watermarking can help identify synthetic text and limit accidental or deliberate misuse4, but has not been adopted in production systems owing to stringent quality, detectability and computational efficiency requirements. Here we describe SynthID-Text, a production-ready text watermarking scheme that preserves text quality and enables high detection accuracy, with minimal latency overhead. SynthID-Text does not affect LLM training and modifies only the sampling procedure; watermark detection is computationally efficient, without using the underlying LLM. To enable watermarking at scale, we develop an algorithm integrating watermarking with speculative sampling, an efficiency technique frequently used in production systems5. Evaluations across multiple LLMs empirically show that SynthID-Text provides improved detectability over comparable methods, and standard benchmarks and human side-by-side ratings indicate no change in LLM capabilities. To demonstrate the feasibility of watermarking in large-scale-production systems, we conducted a live experiment that assessed feedback from nearly 20 million Gemini6 responses, again confirming the preservation of text quality. We hope that the availability of SynthID-Text7 will facilitate further development of watermarking and responsible use of LLM systems.

Practical and lightweight defense against website fingerprinting

Website fingerprinting is a passive network traffic analysis technique that enables an adversary to identify the website visited by a user despite encryption and the use of privacy services such as Tor. Several website fingerprinting defenses built on top of Tor have been proposed to guarantee a user’s privacy by concealing trace features that are important to classification. However, some of the best defenses incur a high bandwidth and/or latency overhead. To combat this, new defenses have sought to be both lightweight — i.e., introduce a small amount of bandwidth overhead — and zero-delay to real network traffic. This work introduces a novel zero-delay and lightweight website fingerprinting defense, called BRO, which conceals the feature-rich beginning of a trace while still enabling the obfuscation of features deeper into the trace without spreading the padding budget thin. BRO schedules padding with a randomized beta distribution that can skew to both the extreme left and right, keeping the applied padding clustered to a finite portion of a trace. This work specifically targets deep learning attacks, which continue to be among the most accurate website fingerprinting attacks. Results show that BRO outperforms other well-known website fingerprinting defenses, such as FRONT, with similar bandwidth overhead.

DONGLE 2.0: Direct FPGA-Orchestrated NVMe Storage for HLS

Rapid growth in data size poses significant computational and memory challenges to data processing. FPGA accelerators and near-storage processing have emerged as compelling solutions for tackling the growing computational and memory requirements. Many FPGA-based accelerators have shown to be effective in processing large data sets by leveraging the storage capability of either host-attached or FPGA-attached storage devices. However, the current HLS development environment does not allow direct access to host-or FPGA-attached NVMe storage from the HLS code. As such, users must frequently hand off between HLS and host code to access data in storage, and such a process requires tedious programming to ensure functional correctness. Moreover, since the HLS code uses radically different methods to access storage compared to DRAM, the HLS codebase targeting DRAM-based platforms cannot be easily ported to NVMe-based platforms, resulting in limited code portability and reusability. Furthermore, frequent suspension of HLS kernel and synchronization between CPU and FPGA introduce significant latency overhead and require sophisticated scheduling mechanisms to hide latency. To address these challenges, we propose a new HLS storage interface named DONGLE 2.0 that enables direct FPGA-orchestrated NVMe storage access. By providing a unified interface for storage and memory access, DONGLE 2.0 allows a single-source HLS program to target multiple memory/storage devices, thus making the codebase cleaner, portable, and more efficient. DONGLE 2.0 is an extension to DONGLE 1.0 [ 1 ] but adds support for host-attached storage. While its primary focus is still on FPGA NVMe access in near-storage configurations, the added host storage support ensures its compatibility with platforms that lack native support for FPGA-attached NVMe storage. We implemented a prototype of DONGLE 2.0 using an AMD/Xilinx Alveo U200 FPGA and Solidigm DC-P4610 SSD. Our evaluation on various workloads showed a geometric mean speed-up of 2.3× and a reduction in lines of code (LoC) by 2.4× compared to the state-of-the-art commercial platform when using FPGA-attached NVMe storage. Moreover, DONGLE 2.0 demonstrated a geometric mean speed-up of 1.5× and a reduction in LoC by 2.4× compared to the state-of-the-art commercial platform when using host-attached NVMe storage.

TrajectoryNAS: A Neural Architecture Search for Trajectory Prediction.

Autonomous driving systems are a rapidly evolving technology. Trajectory prediction is a critical component of autonomous driving systems that enables safe navigation by anticipating the movement of surrounding objects. Lidar point-cloud data provide a 3D view of solid objects surrounding the ego-vehicle. Hence, trajectory prediction using Lidar point-cloud data performs better than 2D RGB cameras due to providing the distance between the target object and the ego-vehicle. However, processing point-cloud data is a costly and complicated process, and state-of-the-art 3D trajectory predictions using point-cloud data suffer from slow and erroneous predictions. State-of-the-art trajectory prediction approaches suffer from handcrafted and inefficient architectures, which can lead to low accuracy and suboptimal inference times. Neural architecture search (NAS) is a method proposed to optimize neural network models by using search algorithms to redesign architectures based on their performance and runtime. This paper introduces TrajectoryNAS, a novel neural architecture search (NAS) method designed to develop an efficient and more accurate LiDAR-based trajectory prediction model for predicting the trajectories of objects surrounding the ego vehicle. TrajectoryNAS systematically optimizes the architecture of an end-to-end trajectory prediction algorithm, incorporating all stacked components that are prerequisites for trajectory prediction, including object detection and object tracking, using metaheuristic algorithms. This approach addresses the neural architecture designs in each component of trajectory prediction, considering accuracy loss and the associated overhead latency. Our method introduces a novel multi-objective energy function that integrates accuracy and efficiency metrics, enabling the creation of a model that significantly outperforms existing approaches. Through empirical studies, TrajectoryNAS demonstrates its effectiveness in enhancing the performance of autonomous driving systems, marking a significant advancement in the field. Experimental results reveal that TrajcetoryNAS yields a minimum of 4.8 higger accuracy and 1.1* lower latency over competing methods on the NuScenes dataset.

DETECTION OF FRAUDULENT PHONE CALLS DETECTION IN MOBILE APPLICATIONS

The primary challenge faced over the course of this decade-long endeavour is the difficulty in devising effective features without direct access to telephony network infrastructure. we conducted an extensive three-month measurement study using these call logs, which encompassed a staggering 9 billion records. Based on the insights gleaned from this study, we identified and designed 29 features that could be used by machine learning algorithms to predict malicious calls. Fraudulent phone calls or scams and spam s via telephone or mobile phone have become a common threat to individuals and organizations. Artificial Intelligence (AI) and Machine Learning (ML) have emerged as powerful tools in detecting and analyzing fraud or malicious calls. This paper presents an overview of AI-based fraud or spam detection and analysis techniques, along with its challenges and potential solutions. The novel fraud call detection approach is proposed that achieved high accuracy and precision. The outcomes revealed that the most effective approach could reduce unblocked malicious calls by up to 90%, while maintaining a precision rate exceeding 93.79% for benign call traffic. Moreover, our analysis demonstrated that these models could be implemented efficiently without incurring significant latency overhead.

A dynamic pricing scheme for secure offloading and resource allocation based on the internet of vehicles

With the development of sixth-generation (6G) wireless communication technology, billions of vehicles will access the network in the future, and the number of vehicle applications and user data will also increase dramatically. Traditional cloud computing faces serious problems of latency and energy consumption in handling massive data. Mobile edge computing (MEC) has emerged to dramatically improve computing efficiency and reduce energy consumption by placing computing servers at network edge locations close to vehicles. However, the service range of MEC servers is limited and cannot fully satisfy user requirements. In addition, the task offloading process has security risks. The current research focuses on how to reduce the energy consumption and latency overhead of task offloading and neglects the economic cost or data transmission security of vehicles. To solve the above problems, we propose a cooperative security offloading (CSO) scheme for auxiliary vehicles and MEC servers. Firstly, we propose a dynamic pricing mechanism for computing resources by considering the credibility of MEC servers and auxiliary vehicles, the urgency of the task, and the number of users competing for auxiliary vehicles. Secondly, to prevent malicious MEC servers and eavesdroppers from attacking, we employ homomorphic encryption to protect user privacy. Meanwhile, efficient and secure computing services are achieved by optimizing user selection decisions, offloading decisions, and resource allocation decisions. Finally, the optimal decisions are obtained by the dueling DQN-based resource allocation and pricing strategy (DDRP) and the cost-minimizing security offloading (CMSO) algorithm, which minimizes the economic cost of users while maximizing security. Simulation results show that, compared with some existing schemes, the CSO scheme effectively reduces the economic cost of users while ensuring the security of data transmission.

High Throughput FPGA-Based Object Detection via Algorithm-Hardware Co-Design

Object detection and classification is a key task in many computer vision applications such as smart surveillance and autonomous vehicles. Recent advances in deep learning have significantly improved the quality of results achieved by these systems, making them more accurate and reliable in complex environments. Modern object detection systems make use of lightweight convolutional neural networks (CNNs) for feature extraction, coupled with single-shot multi-box detectors (SSDs) that generate bounding boxes around the identified objects along with their classification confidence scores. Subsequently, a non-maximum suppression (NMS) module removes any redundant detection boxes from the final output. Typical NMS algorithms must wait for all box predictions to be generated by the SSD-based feature extractor before processing them. This sequential dependency between box predictions and NMS results in a significant latency overhead and degrades the overall system throughput, even if a high-performance CNN accelerator is used for the SSD feature extraction component. In this paper, we present a novel pipelined NMS algorithm that eliminates this sequential dependency and associated NMS latency overhead. We then use our novel NMS algorithm to implement an end-to-end fully pipelined FPGA system for low-latency SSD-MobileNet-V1 object detection. Our system, implemented on an Intel Stratix 10 FPGA, runs at 400 MHz and achieves a throughput of 2,167 frames per second with an end-to-end batch-1 latency of 2.13 ms. Our system achieves 5.3× higher throughput and 5× lower latency compared to the best prior FPGA-based solution with comparable accuracy.

Smooth Passage with the Guards: Second-Order Hardware Masking of the AES with Low Randomness and Low Latency

Cryptographic devices in hostile environments can be vulnerable to physical attacks such as power analysis. Masking is a popular countermeasure against such attacks, which works by splitting every sensitive variable into d+1 randomized shares. The implementation cost of the masking countermeasure in hardware increases significantly with the masking order d, and protecting designs often results in a large overhead. One of the main drivers of the cost is the required amount of fresh randomness for masking the non-linear parts of a cipher. In the case of AES, first-order designs have been built without the need for any fresh randomness, but state-of-the-art higher-order designs still require a significant number of random bits per encryption. Attempts to reduce the randomness however often result in a considerable latency overhead, which is not favorable in practice. This raises the need for AES designs offering a decent performance tradeoff, which are efficient both in terms of required randomness and latency.In this work, we present a second-order AES design with the minimal number of three shares, requiring only 3 200 random bits per encryption at a latency of 5 cycles per round. Our design represents a significant improvement compared to state-of-the-art designs that require more randomness and/or have a higher latency. The core of the design is an optimized 5-cycle AES S-box which needs 78 bits of fresh randomness. We use this S-box to construct a round-based AES design, for which we present a concept for sharing randomness across the S-boxes based on the changing of the guards (COTG) technique. We assess the security of our design in the probing model using a formal verification tool. Furthermore, we evaluate the practical side-channel resistance on an FPGA.

Region-aware dynamic job scheduling and resource efficiency for load balancing based on adaptive chaotic sparrow search optimization and coalitional game in cloud computing environments

Uneven distribution of workloads represents a significant challenge in cloud data centers, negatively impacting the efficient utilization of resources. To address this problem and optimize the performance-to-profit (PP) ratio, we introduced the Regional Awareness dynamic Scheduling Algorithm (RASA) through a three-phase approach. In the initial phase, tasks are categorized based on critical parameters like CPU usage, memory utilization, and I/O operations, using a task classification model. The second phase involves estimating the CPU, memory, and I/O capacities of each node. Subsequently, a unique merge-and-split-based coalitional game-theoretic process is employed to group nodes into clusters. In the final phase, we have improved task placement by introducing an enhanced Sparrow Search Algorithm (ISSA) to overcome the slow convergence and local optimization issues found in the traditional SSA. We have incorporated the Tent chaotic mapping approach to enhance both global and local search efficiency during this stage. Additionally, we have fine-tuned fair load distribution using the Cauchy mutation process. We performed simulations using the CloudSim toolkit, and the results underscore the RASA algorithm’s superiority in terms of how quickly it converges its precision in task placement and its ability to distribute workloads fairly. Our proposed algorithm achieves a 9% reduction in latency overhead, a 14% decrease in processing time, a 15% reduction in workload imbalance, a 19% decrease in energy consumption, and a 26% decrease in idle periods. Furthermore, it enhances resource availability and efficiency by 22% and 27% respectively, while simultaneously boosting service throughput by 32%.

A comprehensive analysis of website fingerprinting defenses on Tor

Website fingerprinting (WF) enables eavesdroppers to identify the website a user is visiting by network surveillance, even if the traffic is protected by anonymous communication technologies such as Tor. To avoid this, several defense schemes have been proposed to protect users from the hazard of website fingerprinting attacks. However, some defenses are defeated by new attacks soon since they can not provide provable security guarantees; some defenses can not be deployed in practice since they incur high bandwidth overhead and latency overhead. In this paper, we survey existing WF defense schemes and make a comprehensive analysis. First, we divide WF defenses into four categories and introduce their principles and characteristics separately. Then, we point out some unreasonable settings in previous works and use a new experimental setting to evaluate WF defenses on a public dataset. We find many WF defenses are not as effective as they claim to be. Besides, we investigate the deployment of WF defenses and discuss some potential problems. Finally, we make some suggestions for researchers to design a feasible WF defense and make suggestions for users to protect their privacy.

Message Authentication and Provenance Verification for Industrial Control Systems

Successful attacks against industrial control systems (ICSs) often exploit insufficient checking mechanisms. While firewalls, intrusion detection systems, and similar appliances introduce essential checks, their efficacy depends on the attackers’ ability to bypass such middleboxes. We propose a provenance solution to enable the verification of an end-to-end message delivery path and the actions performed on a message. Fast and flexible provenance verification (F2-Pro) provides cryptographically verifiable evidence that a message has originated from a legitimate source and gone through the necessary checks before reaching its destination. F2-Prorelies on lightweight cryptographic primitives and flexibly supports various communication settings and protocols encountered in ICS thanks to its transparent, bump-in-the-wire design. We provide formal definitions and cryptographically prove F2-Pro’s security. For human interaction with ICS via a field service device, F2-Profeatures a multi-factor authentication mechanism that starts the provenance chain from a human user issuing commands. We compatibility tested F2-Proon a smart power grid testbed and reported a sub-millisecond latency overhead per communication hop using a modest ARM Cortex-A15 processor.

End-to-end Privacy Preserving Training and Inference for Air Pollution Forecasting with Data from Rival Fleets

Privacy-preserving machine learning (PPML) promises to train machine learning (ML) models by combining data spread across multiple data silos. Theoretically, secure multiparty computation (MPC) allows multiple data owners to train models on their joint data without revealing the data to each other. However, the prior implementations of this secure training using MPC have three limitations: they have only been evaluated on CNNs, and LSTMs have been ignored; fixed point approximations have affected training accuracies compared to training in floating point; and due to significant latency overheads of secure training via MPC, its relevance for practical tasks with streaming data remains unclear. The motivation of this work is to report our experience of addressing the practical problem of secure training and inference of models for urban sensing problems, e.g., traffic congestion estimation, or air pollution monitoring in large cities, where data can be contributed by rival fleet companies while balancing the privacy-accuracy trade-offs using MPC-based techniques.Our first contribution is to design a custom ML model for this task that can be efficiently trained with MPC within a desirable latency. In particular, we design a GCN-LSTM and securely train it on time-series sensor data for accurate forecasting, within 7 minutes per epoch. As our second contribution, we build an end-to-end system of private training and inference that provably matches the training accuracy of cleartext ML training. This work is the first to securely train a model with LSTM cells. Third, this trained model is kept secret-shared between the fleet companies and allows clients to make sensitive queries to this model while carefully handling potentially invalid queries. Our custom protocols allow clients to query predictions from privately trained models in milliseconds, all the while maintaining accuracy and cryptographic security.

ObNoCs : Protecting Network-on-Chip Fabrics Against Reverse-Engineering Attacks

Modern System-on-Chip designs typically use Network-on-Chip (NoC) fabrics to implement coordination among integrated hardware blocks. An important class of security vulnerabilities involves a rogue foundry reverse-engineering the NoC topology and routing logic. In this paper, we develop an infrastructure, ObNoCs , for protecting NoC fabrics against such attacks. ObNoCs systematically replaces router connections with switches that can be programmed after fabrication to induce the desired topology. Our approach provides provable redaction of NoC functionality: switch configurations induce a large number of legal topologies, only one of which corresponds to the intended topology. We implement the ObNoCs methodology on Intel Quartus™ Platform, and experimental results on realistic SoC designs show that the architecture incurs minimal overhead in power, resource utilization, and system latency.

MapChain-D: A Distributed Blockchain for IIoT Data Storage and Communications

With the rapid growth of the Industrial Internet of Things (IIoT) devices, managing extensive volume of IIoT data becomes a significant challenge. While the conventional cloud storage approaches with centralised data centres suffer from high latency for large-scale IIoT data storage due to the increased communications and latency overheads, distributed storage frameworks such as blockchains have become promising solutions. In this paper, we design and analyse a dual-blockchain framework for secure and scalable distributed data management in large-scale IIoT networks. The proposed framework, named <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">MapChain-D</i> , consists of a data chain that is mapped to an index chain to provide efficient data storage and lookup. <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">MapChain-D</i> is designed for practical IIoT applications with storage, latency, and communications constraints. Detailed data exchange protocols are presented for the data insertion and retrieval operations in <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">MapChain-D</i> . Based on these, theoretical analyses are provided on the space, time, and communications complexities of <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">MapChain-D</i> compared with conventional single-chain frameworks with local and distributed data storage. We implement our <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">MapChain-D</i> prototype using open-source LoRaWAN communications with multiple RPi and Arduino devices, Kademlia-based distributed hash table (DHT), and Ethereum-based blockchain with proof-of-authority (PoA) consensus. Experimental results from our prototype show that <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">MapChain-D</i> is more suitable to be deployed on resource-constrained IIoT devices. We also highlight the scalability and flexibility of <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">MapChain-D</i> with different numbers of edge nodes in the system.

Improving power and performance of on-chip network through virtual channel sharing and power gating

Networks-on-Chip (NoCs) are becoming the communication backbone in multicore chips. The router buffer holds a critical significance for the communication performance of NoC. However, the bursty traffic means that the buffers are idle for many periods and generate a significant amount of static power. Moreover, due to the uneven traffic distribution, some buffers within the router stand idle even at network saturation. Both the performance and power budget of NoC heavily depends on the router’s buffer budget. Therefore, we desperately demand a mechanism to maximize the usage of idle buffers to balance the load and improve the performance ceiling of NoC. Dynamically based on network traffic, early switching on or off of buffers to save power consumption. We propose a modified microarchitecture of the virtual channel sharing router, MVCR. The MVCR innovatively applies aggressive fine-grained power gating mechanisms to the idle buffers of each directional input port (east, west, south, and north) to achieve static power savings. Moreover, the MVCR further extends the sleeping VC period through an efficient packet-transmission adjustment mechanism, thus achieving maximum static power savings and improved network performance. Synthetic applications and real benchmarks have been used to validate MCVR. Compared to traditional router scheme, MVCR increases throughput by 30%, reduces power consumption by 47%, and has a latency overhead of about 6%. The key performance metrics are better than other solutions, and the added area cost is moderate.

Scalable and Secure Virtualization of HSM With ScaleTrust

Hardware security modules (HSMs) have been utilized as a trustworthy foundation for cloud services. Unfortunately, existing systems using HSMs fail to meet multi-tenant scalability arising from the emerging trends such as microservices, which utilize frequent cryptographic operations. As an alternative, cloud vendors provide HSMs as a service. However, such cloud-managed HSM usage models raise security concerns due to their untrusted and shared operating environment. We propose ScaleTrust, a scalable and secure system for key management. ScaleTrust allows us to scale the number of virtual HSM partitions, each of which is isolated with respect to each other and is robust against cloud insider attacks, while preserving physical isolation of the root of trust. To enable this, ScaleTrust uses Intel SGX and multiple HSM features, such as restricting key usage by controlling key attributes of in-HSM keys and establishing a secure channel using only HSM commands. Finally, we apply ScaleTrust to four real-world systems: Keyless SSL for TLS private key offloading, JSON Web Token authentication for microservices, key provisioning, and encryption in database systems. Our evaluation shows that ScaleTrust achieves multi-tenancy in a scalable way by providing multiple virtual HSMs with legacy HSM devices that are designed to support a single tenant. ScaleTrust provides security against insider threats while incurring 11.9% and 39.0% of end-to-end throughput and latency overhead for Keyless SSL compared to stand-alone HSMs.

AntCom: An effective and efficient anti-tracking system with dynamic and asymmetric communication channel

The increasingly rampant network monitoring and tracing bring the huge challenge on the protection of network users’ privacy. Even though the existing anonymous systems mitigate these threats, they often sacrifice anonymity for efficiency or vice-versa. Systems that offer strong privacy guarantees, such as Dissent, have high cost in computation and communication efficiency. Scalable systems, such as Tor, have low resistance to traffic analysis. We present AntCom, an effective and efficient communication system that provides low latency and high tracking-resistance. AntCom improves the tracking-resistance of communication via bidirectional ring communication. Different with the communication path with multiple hops, AntCom establishes a communication ring which is constructed by several nodes in bidirectional ring structure. The communication ring randomly chooses its exit node by collaborative decryption to deliver the message to achieve the dynamics of communication path. Because of the bidirectional ring structure, the uplink and downlink of two users’ communication will be split in the communication ring. Then, AntCom decrease the overlap of the paths in the uplink and downlink, and improves the tracking-resistance when confronted with the association-analysis based network tracing. Our evaluations of AntCom in latency overhead and tracking-resistance show that the latency of AntCom is linearly proportional to the size of communication ring, and the tracking-resistance of AntCom performs better than the multi-hops based anonymous system.