Latency Overhead Research Articles

Energy‐efficient multi‐biometric system for Internet of Things using trust management

The traditional password-based authentication systems are easy to breach because they rely on what the user knows and not on who is the user. This makes them prone to impersonation, as the culprit can gain access to the system once they knew the user's password, which led to the development of biometric-based authentication systems. Nonetheless, noisy data, intra-, and inter-class variations render these systems inaccurate. However, combining multiple biometric traits (multi-biometric systems) promises to increase the accuracy of biometric systems. But, this leads to an overhead in energy and latency in the system. These overheads are frowned at in embedded systems, especially those deployed in remote areas. Here, the authors propose a trust management-based multi-biometric system. The system switches between a uni-biometric and a multi-biometric system to achieve high accuracy and reduced overhead (i.e. energy and latency). The system uses the uni-biometric technique for trusted users and the multi-biometric method for untrustworthy users who are zero-effort impostors. It is found to reduce the false positive rate by 0.29 of Fingerprint uni-biometric system and the false negative rate by a factor of 0.5 of the multi-biometric system. Also, the energy consumption is reduced by a factor of 0.2 of the multi-biometric system.

New First-Order Secure AES Performance Records

Being based on a sound theoretical basis, masking schemes are commonly applied to protect cryptographic implementations against Side-Channel Analysis (SCA) attacks. Constructing SCA-protected AES, as the most widely deployed block cipher, has been naturally the focus of several research projects, with a direct application in industry. The majority of SCA-secure AES implementations introduced to the community opted for low area and latency overheads considering Application-Specific Integrated Circuit (ASIC) platforms. Albeit a few, those which particularly targeted Field Programmable Gate Arrays (FPGAs) as the implementation platform yield either a low throughput or a not-highly secure design.In this work, we fill this gap by introducing first-order glitch-extended probing secure masked AES implementations highly optimized for FPGAs, which support both encryption and decryption. Compared to the state of the art, our designs efficiently map the critical non-linear parts of the masked S-box into the built-in Block RAMs (BRAMs).The most performant variant of our constructions accomplishes five first-order secure AES encryptions/decryptions simultaneously in 50 clock cycles. Compared to the equivalent state-of-the-art designs, this leads to at least 70% reduction in utilization of FPGA resources (slices) at the cost of occupying BRAMs. Last but not least, we provide a wide range of such secure and efficient implementations supporting a large set of applications, ranging from low-area to high-throughput.

High-fidelity indoor MIMO radio access for 5G and beyond based on legacy multimode fiber and real-time analog-to-digital-compression.

Dedicated indoor radio access network (RAN, such as C-RAN with fronthaul) will be in urgent demand for 5G and beyond ((B)5G), as it becomes more difficult for outdoor base stations to serve indoor mobile/IoT terminals due to the loss issue induced by higher carrier frequency. One cost-effective and time-saving strategy for indoor (B)5G RAN is to reuse the legacy multimode fibers (MMF) deployed in buildings and premises worldwide. In this work, we introduce the concept of indoor (B)5G fronthaul over legacy MMF based on analog-to-digital-compression (ADX), termed as ADX-RoMMF. Enabled by ADX for MIMO data compression, both high radio signal fidelity and fronthaul bandwidth efficiency can be achieved, which alleviates the limitation of low MMF bandwidth-distance product and supports decent indoor coverage. Meanwhile, its digital nature is highly compatible with low-cost optical transceivers (with nonlinearity and/or imperfection) and packet-based fronthaul networking such as time-sensitive networking. Furthermore, the ultralow latency of ADX processing meets the requirement of low-delay (B)5G fronthauling. We experimentally demonstrate an ADX-RoMMF link serving 16-channel MIMO signals with NR-class bandwidth and 1024QAM, leveraging a real-time ADX prototyped on a single-chip field-programmable radio platform. Results show that this 32Gb/s CPRI-equivalent rate can be transported over MMF distance of 850m within 1024QAM EVM requirement, which is 4-fold larger than that of conventional fronthaul compression scheme. Moreover, 500ns ADX latency overhead is also verified.

Scalable Unsupervised ML: Latency Hiding in Distributed Sparse Tensor Decomposition

Latency overhead in distributed-memory parallel CPD-ALS scales with the number of processors, limiting the scalability of computing CPD of large irregularly sparse tensors. This overhead comes in the form of sparse reduce and expand operations performed on factor-matrix rows via point-to-point messages. We propose to hide the latency overhead through embedding all of the point-to-point messages incurred by the sparse reduce and expand into dense collective operations which already exist in the CPD-ALS. The conventional parallel CPD-ALS algorithm is not amenable for embedding so we propose a computation/communication rearrangement to enable the embedding. We embed the sparse expand and reduce into a hypercube-based ALL-REDUCE operation to limit the latency overhead to O(log K) for a K-processor system. The embedding comes with the cost of increased bandwidth overhead due to the multi-hop routing of factor-matrix rows during the embedded-ALL-REDUCE. We propose an embedding scheme that takes advantage of the expand/reduce properties to reduce this overhead. Furthermore, we propose a novel recursive bipartitioning framework that enables simultaneous hypergraph partitioning and subhypergraph-to-subhypercube mapping to achieve subtensor-to-processor assignment with the objective of reducing the bandwidth overhead during the embedded-ALL-REDUCE. We also propose a bin-packing-based algorithm for factor-matrix row to processor assignment aiming at reducing processors maximum send and receive volumes during the embedded-ALL-REDUCE. Experiments on up to 4096 processors show that the proposed framework scales significantly better than the state-of-the-art point-to-point method.

Arithmetic Coding-Based 5-Bit Weight Encoding and Hardware Decoder for CNN Inference in Edge Devices

Convolutional neural networks (CNNs) have gained a huge attention for real-world artificial intelligence (AI) applications such as image classification and object detection. On the other hand, for better accuracy, the size of the CNNs’ parameters (weights) has been increasing, which in turn makes it difficult to enable on-device CNN inferences in resource-constrained edge devices. Though weight pruning and 5-bit quantization methods have shown promising results, it is still challenging to deploy large CNN models in edge devices. In this paper, we propose an encoding and hardware-based decoding technique which can be applied to 5-bit quantized weight data for on-device CNN inferences in resource-constrained edge devices. Given 5-bit quantized weight data, we employ arithmetic coding with range scaling for lossless weight compression, which is performed offline. When executing on-device inferences with underlying CNN accelerators, our hardware decoder enables a fast in-situ weight decompression with small latency overhead. According to our evaluation results with five widely used CNN models, our arithmetic coding-based encoding method applied to 5-bit quantized weights shows a better compression ratio by 9.6× while also reducing the memory data transfer energy consumption by 89.2%, on average, as compared to the case of uncompressed 32-bit floating-point weights. When applying our technique to pruned weights, we obtain better compression ratios by 57.5×–112.2× while reducing energy consumption by 98.3%–99.1% as compared to the case of 32-bit floating-point weights. In addition, by pipelining the weight decoding and transfer with the CNN execution, the latency overhead of our weight decoding with 16 decoding unit (DU) hardware is only 0.16%–5.48% and 0.16%–0.91% for non-pruned and pruned weights, respectively. Moreover, our proposed technique with 4-DU decoder hardware reduces system-level energy consumption by 1.1%–9.3%.

CollabLoc: Privacy-Preserving Multi-Modal Collaborative Mobile Phone Localization

Mobile location-based services are important context-aware services that are more and more used for enforcing security policies, for supporting indoor room navigation, and for providing personalized assistance. However, a major problem still remains unaddressed-the lack of solutions that work across buildings while not using additional infrastructure and also accounting for privacy and reliability needs. A privacy-preserving, multi-modal, cross-building, collaborative localization platform is proposed based on Wi-Fi Received Signal Strength Indicator (RSSI) (existing infrastructure), Cellular RSSI, sound, light, and geo-magnetic levels, that enables sub-room level localization. The solution is fully based on mobile phones and existing Wi-Fi infrastructure, and has privacy inherently built into it via cryptographically-secured onion routing and perturbation/randomization techniques. It also exploits the idea of weighted collaboration to increase the reliability as well as to limit the effect of noisy devices (due to sensor noise/privacy). The solution has been analyzed in terms of latency overhead due to onion-routing, request load on phones, privacy-accuracy tradeoffs, optimum parameters, granularity, different classification algorithms using real location data collected at multiple indoor and outdoor locations via an Android application. The additional features other than Wi-Fi RSSI values are shown to increase the accuracy to a maximum of 15 percent, while considering Geo-magnetic field is shown to enhance the granularity from 2.5 m to ≈1 m, a 60 percent improvement.

Mitigation of Kernel Memory Corruption Using Multiple Kernel Memory Mechanism

Operating systems adopt kernel protection methods (e.g., mandatory access control, kernel address space layout randomization, control flow integrity, and kernel page table isolation) as essential countermeasures to reduce the likelihood of kernel vulnerability attacks. However, kernel memory corruption can still occur via the execution of malicious kernel code at the kernel layer. This is because the vulnerable kernel code and the attack target kernel code or kernel data are located in the same kernel address space. To gain complete control of a host, adversaries focus on kernel code invocations, such as function pointers that rely on the starting points of the kernel protection methods. To mitigate such subversion attacks, this paper presents multiple kernel memory (MKM), which employs an alternative design for kernel address space separation. The MKM mechanism focuses on the isolation granularity of the kernel address space during each execution of the kernel code. MKM provides two kernel address spaces, namely, i) the trampoline kernel address space, which acts as the gateway feature between user and kernel modes and ii) the security kernel address space, which utilizes the localization of the kernel protection methods (i.e., kernel observation). Additionally, MKM achieves the encapsulation of the vulnerable kernel code to prevent access to the kernel code invocations of the separated kernel address space. The evaluation results demonstrated that MKM can protect the kernel code and kernel data from a proof-of-concept kernel vulnerability that could lead to kernel memory corruption. In addition, the performance results of MKM indicate that the system call overhead latency ranges from 0.020 μs to 0.5445 μs, while the web application benchmark ranges from 196.27 μs to 6, 685.73 μs for each download access of 100,000 Hypertext Transfer Protocol sessions. MKM attained a 97.65% system benchmark score and a 99.76% kernel compilation time.

FlexChain: Bridging Parallelism and Placement for Service Function Chains

A Service Function Chain (SFC) is an ordered sequence of network functions (NFs). With the emerging Network Function Virtualization (NFV) paradigm, NFs can be deployed as software instances on commodity servers, leading to a more flexible provision of network service. However, the flexibility of NFV comes with considerable compromises since virtual network functions (VNFs) introduce significant processing latency overheads. In this article, we design a flexible SFC parallel system called FlexChain, enabling the parallelism among VNFs to reduce the processing latency of SFCs. To leverage the benefits of parallelism, we study the problem of joint optimization over SFC parallelism and placement with the objective of accepting as many requests as possible. Since the problem is proved to be NP-hard, we propose a parallelism-aware approximation placement algorithm with performance guarantees, and an efficient heuristic algorithm for large-scale data center networks. Our simulation results show that FlexChain combined with our placement algorithm can substantially improve the number of accepted flows in the latency-sensitive scenario, and significantly reduce the average latency of accepted flows at the same time.

ThingsMigrate: Platform‐independent migration of stateful JavaScript Internet of Things applications

AbstractThe Internet of Things (IoT) has gained wide popularity both in academic and industrial contexts. Unlike traditional embedded devices with specialized firmwares, modern IoT devices accommodate general‐purpose operating systems, allowing developers to run more sophisticated applications written in high‐level languages like JavaScript. Because IoT devices are subject to resource constraints like available battery power, we need to dynamically migrate a running process between different devices to prevent losing state. However, it is challenging to apply migration techniques using memory snapshots across the heterogeneous pool of IoT devices. We present ThingsMigrate, a middleware providing platform‐independent migration of JavaScript processes across IoT devices. Prior to execution, ThingsMigrate instruments the source code of a given program to expose its internal state. During run‐time, the transformed program produces on demand a JSON snapshot of its current state, from which new code is generated to resume execution. Thus, ThingsMigrate enables process migration entirely in the application space without any modifications to the underlying virtual machine (VM), providing VM‐independence. We present three versions of ThingsMigrate, each building on the previous to optimize for run‐time latency and memory consumption. We report on the experience of building each successive version and discuss the insights gained and the learning outcomes. We evaluated ThingsMigrate against standard benchmarks, over two IoT platforms and a cloud‐like environment. We show that it can migrate even highly CPU‐intensive applications, with average run‐time latency overhead of 33% and memory overhead of 78%. ThingsMigrate supports multiple subsequent migrations without introducing additional overhead over each subsequent migration.

Re-Consolidating First-Order Masking Schemes

Application of masking, known as the most robust and reliable countermeasure to side-channel analysis attacks, on various cryptographic algorithms has dedicated a lion’s share of research to itself. The difficulty originates from the fact that the overhead of application of such an algorithmic-level countermeasure might not be affordable. This includes the area- and latency overheads and the amount of fresh randomness required to fulfill the resulting design’s security properties. There are already techniques applicable in hardware platforms that consider glitches into account. Among them, classical threshold implementations force the designers to use at least three shares in the underlying masking. The other schemes, which can deal with two shares, often necessitates the use of fresh randomness.Here, in this work, we present a technique allowing us to use two shares to realize the first-order glitch-extended probing secure masked realization of several functions, including the S-box of Midori, PRESENT, PRINCE, and AES ciphers without any fresh randomness.

Light-weight AI and IoT collaboration for surveillance video pre-processing

Abstract As one of the internet of things (IoT) use cases, wireless surveillance systems are rapidly gaining popularity due to their easier deployability and improved performance. Videos captured by surveillance cameras are required to be uploaded for further storage and analysis, while the large amount of its raw data brings great challenges to the transmission through resource-constraint wireless networks. Observing that most collected consecutive frames are redundant with few objects of interest (OoIs), the filtering of these frames before uploading can dramatically relieve the transmission pressure. Additionally, real-world monitoring environment may bring shielding or blind areas in videos, which notoriously affects the accuracy on frame filtering. The collaboration between neighbouring cameras can compensate for such accuracy loss. Under the computational constraint of edge cameras, we present an efficient video pre-processing strategy for wireless surveillance systems using light-weight AI and IoT collaboration. Two main modules are designed for either fixed or rotated cameras: (i) frame filtering module by dynamic background modelling and light-weight deep learning analysis; and (ii) collaborative validation module for error compensation among neighbouring cameras. Evaluations based on real-collected videos show the efficiency of this strategy. It achieves 64.4% bandwidth saving for the static scenario and 61.1% for the dynamic scenario, compared with the raw video transmission. Remarkably, the relatively high balance ratio between frame filtering accuracy and latency overhead outperforms than state-of-the-art light-weight AI structures and other surveillance video processing methods, implying the feasibility of this strategy.

AirNN: A Featherweight Framework for Dynamic Input-Dependent Approximation of CNNs

In this work, we propose AirNN, a novel framework which enables dynamic approximation of an already-trained convolutional neural network (CNN) in hardware during inference. AirNN enables input-dependent approximation of the CNN to achieve energy saving without much degradation in its classification accuracy at runtime. For each input, AirNN uses only a fraction of the CNN’s weights based on that input (with the rest remaining 0) to conduct the inference. Consequently, energy saving is possible due to fewer number of fetches from off-chip memory as well as fewer multiplications for majority of the inputs. To achieve per-input approximation, we propose a clustering algorithm that groups similar weights in the CNN based on their importance, and design an iterative framework that decides dynamically how many clusters of weights should be fetched from off-chip memory for each individual input. We also propose new hardware structures to implement our framework on top of a recently proposed FPGA-based CNN accelerator. In our experiments with popular CNNs, we, on average, show 49% energy saving with less than 3% degradation in classification accuracy due to doing inference with only a fraction of the weights for the majority of the inputs. We also propose a greedy interleaving scheme, implemented in hardware, in order to improve the performance of the iterative procedure and compensate for its latency overhead.

Mobius: Packet Re-processing Hardware Architecture for Rich Policy Handling on a Network Processor

Network devices generally handle traffic with predefined policies that describe the operation of packets. Since these policies explain network operation, the number of policies in network devices naturally increases as the scale of a network. Unfortunately, processing a large number of policies may lead to performance loss; Although many policies can be stored in memory, a network processor in a network device can only handle a limited number of policies at once so that the policies should be divided and processed into several groups. Thus, the processing time for one packet will be delayed, and it can fill up an input buffer of the device and drop packets. However, improving a processor that supports large capacity is not an efficient way because it also increases the cost of the processor. To address these challenges, we propose a hardware architecture for network processors called Mobius. It allows a processor to re-process packets n more times with different policies by utilizing the idle resources of the processor caused by the propagation time of packets on a wire. Consequently, Mobius extends the capacity of the processor at a low-cost so that more policies can be processed for packets without performance loss. We implement the prototype of Mobius using NetFPGA-SUME and our evaluation demonstrates that Mobius achieves a line-rate throughput with a tiny latency overhead. A comparison with other network processor models shows that Mobius exhibits a similar performance but is more economical.

Design and Implementation of a Compressed Certificate Status Protocol

Trust in Secure Sockets Layer–based communications is traditionally provided by Certificate (or Certification) Authorities (CAs) in the form of signed certificates. Checking the validity of a certificate involves three steps: (i) checking its expiration date, (ii) verifying its signature, and (iii) ensuring that it is not revoked. Currently, such certificate revocation checks (i.e., step (iii) above) are done either via Certificate Revocation Lists (CRLs), or Online Certificate Status Protocol (OCSP) servers. Unfortunately, despite the existence of these revocation checks, sophisticated cyber-attackers can still trick web browsers to trust a revoked certificate, believing that it is still valid. Although frequently updated , nonced , and timestamped certificates can reduce the frequency and impact of such cyber-attacks, they add a huge burden to the CAs and OCSP servers. Indeed, CAs and/or OCSP servers need to timestamp and sign on a regular basis all the responses, for every certificate they have issued, resulting in a very high overhead. To mitigate this and provide a solution to the described cyber-attacks, we present CCSP : a new approach to provide timely information regarding the status of certificates, which capitalizes on a newly introduced notion called Signed Collections . In this article, we present in detail the notion of Signed Collections and the complete design, implementation, and evaluation of our approach. Performance evaluation shows that CCSP (i) reduces space requirements by more than an order of magnitude, (ii) lowers the number of signatures required by six orders of magnitude compared to OCSP-based methods, and (iii) adds only a few milliseconds of overhead in the overall user latency.

Protector: A Permanent Fault Resilient Router Architecture for Network on Chip

The decreasing size of the transistor has increased the vulnerability towards faults. Increasing number of cores on a single chip has made the concept of Network on Chip (NoC) a standard communication backbone among cores. This facility comes with vulnerability of faults in the system due to decreasing size of transistors. A permanent fault in the network leads to undesirable consequence such as permanent blocking of flits or failure of the whole router. Preserving the router in the operational state has a significant impact on the reliability of the system. Permanent fault in buffers and pipeline stages of the router has a high impact on performance. The proposed router architecture Protector provides faults protection to both buffers and pipelines stages by exploiting the concepts of borrowing from other resources, using bypass paths and by creating multiple paths to reach output. The proposed router incurred an area overhead of 30% as compared to the baseline design. Reliability analysis using Silicon Protection Factor indicates that the proposed router has better fault tolerance efficiency as compared to state of the art. Latency analysis using PARSEC and SPLASH-2 benchmarks indicates proposed router incurs 13% and 16% latency overhead in the presence of faults.

PriFi: Low-Latency Anonymity for Organizational Networks

AbstractOrganizational networks are vulnerable to trafficanalysis attacks that enable adversaries to infer sensitive information fromnetwork traffic—even if encryption is used. Typical anonymous communication networks are tailored to the Internet and are poorly suited for organizational networks.We present PriFi, an anonymous communication protocol for LANs, which protects users against eavesdroppers and provides high-performance traffic-analysis resistance. PriFi builds onDining Cryptographers networks (DC-nets), but reduces the high communication latency of prior designs via a new client/relay/server architecture, in which a client’s packets remain on their usual network path without additional hops, and in which a set of remote servers assist the anonymization process without adding latency. PriFi also solves the challenge of equivocation attacks, which are not addressed by related work, by encrypting traffic based on communication history. Our evaluation shows that PriFi introduces modest latency overhead (≈ 100ms for 100 clients) and is compatible with delay-sensitive applications such as Voice-over-IP.

Design of an Area-Efficient Computing in Memory Platform Based on STT-MRAM

In the era of big data, the memory wall between the processor and the memory as well as leakage current have become major bottlenecks of the traditional CMOS-based Von-Neumann computer architecture. Computing-in-memory (CiM) based on non-volatile memories (NVMs) is considered a promising method to solve the above-mentioned issues in computing systems. In this article, we propose a CiM platform based on spin-transfer torque magnetic random access memory (STT-MRAM). On the basis of the conventional CiM with AND/OR logic functions, the full-adder (FA) arithmetic operation is achieved with slight circuits modification by exploiting majority logic. Due to the parallel processing of carry and sum operations in multi-bit FA operation, the latency overhead caused by the two-step scheme is acceptable. The hybrid spintronic/CMOS simulations on the 40 nm technology node prove the functionality and performance of the proposed CiM platform.

Scaling Up Anonymous Communication with Efficient Nanopayment Channels

Abstract Tor, the most widely used and well-studied traffic anonymization network in the world, suffers from limitations in its network diversity and performance. We propose to mitigate both problems simultaneously through the introduction of a premium bandwidth market between clients and relays. To this end, we present moneTor: incentivizing nodes to join and support Tor by giving them anonymous payments from Tor users. Our approach uses efficient cryptographic nanopayments delivered alongside regular Tor traffic. Our approach also gives a degree of centralized control, allowing Tor’s managers to shape the economy created by these payments. In this paper, we present a novel payment algorithm as well as a data-driven simulation and evaluation of its costs and benefits. The results show that moneTor is both feasible and flexible, offering upwards of 100% improvements in differentiated bandwidth for paying users with near-optimal throughput and latency overheads.

Comprehensive Anonymity Trilemma: User Coordination is not enough

Abstract For anonymous communication networks (ACNs), Das et al. recently confirmed a long-suspected trilemma result that ACNs cannot achieve strong anonymity, low latency overhead and low bandwidth overhead at the same time. Our paper emanates from the careful observation that their analysis does not include a relevant class of ACNs with what we call user coordination where users proactively work together towards improving their anonymity. We show that such protocols can achieve better anonymity than predicted by the above trilemma result. As the main contribution, we present a stronger impossibility result that includes all ACNs we are aware of. Along with our formal analysis, we provide intuitive interpretations and lessons learned. Finally, we demonstrate qualitatively stricter requirements for the Anytrust assumption (all but one protocol party is compromised) prevalent across ACNs.

Securing Cyber-Physical Systems from Hardware Trojan Collusion

Hardware Trojans, which are malicious modifications made to circuits, may cause severe security issues in Cyber-Physical Systems (CPS). CPS are usually composed of multiple untrusted nodes and a trusted server, with each node connecting to the server wirelessly in a multi-hop manner. A Trojan in one node may broadcast messages with triggers secretly embedded to simultaneously activate multiple Trojans in other nodes, causing system-wide catastrophe. To prevent hardware Trojan collusion in CPS, this paper presents a collaborative defensive framework. When deploying the network, a security requirement of vendor diversity is enforced between neighboring nodes, thus precluding collusion between neighboring nodes and allowing them to monitor each other's behavior. At runtime, a mutual auditing protocol is utilized to check, for each message, whether it is correctly encrypted by the source node and whether its content is maliciously changed by any node on the routing path. This protocol ensures that any message embedded with hardware Trojan trigger is either muted or detected and abandoned, while the benign messages are thwarted. The experimental results show that the framework effectively prevents hardware Trojan collusion with low latency overhead and almost no impact on packet completion rate and network throughput.