Security-aware Scheduling Research Articles

Protection Window Based Security-Aware Scheduling against Schedule-Based Attacks

With widespread use of common-off-the-shelf components and the drive towards connection with external environments, the real-time systems are facing more and more security problems. In particular, the real-time systems are vulnerable to the schedule-based attacks because of their predictable and deterministic nature in operation. In this paper, we present a security-aware real-time scheduling scheme to counteract the schedule-based attacks by preventing the untrusted tasks from executing during the attack effective window (AEW). In order to minimize the AEW untrusted coverage ratio for the system with uncertain AEW size, we introduce the protection window to characterize the system protection capability limit due to the system schedulability constraint. To increase the opportunity of the priority inversion for the security-aware scheduling, we design an online feasibility test method based on the busy interval analysis. In addition, to reduce the run-time overhead of the online feasibility test, we also propose an efficient online feasibility test method based on the priority inversion budget analysis to avoid online iterative calculation through the offline maximum slack analysis. Owing to the protection window and the online feasibility test, our proposed approach can efficiently provide best-effort protection to mitigate the schedule-based attack vulnerability while ensuring system schedulability. Experiments show the significant security capability improvement of our proposed approach over the state-of-the-art coverage oriented scheduling algorithm.

Cost-efficient security-aware scheduling for dependent tasks with endpoint contention in edge computing

Edge computing empowers latency-sensitive and computation-intensive applications composed of multiple dependent tasks of mobile devices to execute on nearby edge servers. Despite the advantages, intermediate data across edge servers faces external security threats. Moreover, most existing works on task scheduling are designed on the idealized system model where communications are performed in parallel, they neglect the endpoint contention problem during data transmission, and thereby can hardly meet the user-specified deadline. To tackle these issues, this paper studies the endpoint contention-aware scheduling problem for dependent tasks to minimize the execution cost under the security and deadline constraints in the edge computing environment. We propose a heuristic algorithm named CSSDE that first distributes the deadline to each task and sorts tasks according to probabilistic endpoint contention-aware upward rank, and then allocates bandwidth resources and computation resources to intermediate data and tasks, respectively, finally performs rescheduling to improve the initial scheduling scheme. In addition, based on CSSDE and genetic algorithm, we present a metaheuristic algorithm called C-GA that considers the impact of task ordering and incorporates a multi-population co-evolution mechanism to enhance population diversity and avoid falling into local optimum for a better scheduling scheme. Simulation experiments are conducted on synthetic and real-world applications. The results demonstrate that our proposed algorithms achieve a higher success rate, and C-GA reduces the execution cost by 43.92, 40.52, and 8.56 percent compared with SCAS-E, ELSH, and CSSDE, respectively.

Scheduling Real-Time Security Aware Tasks in Fog Networks

Fog computing brings the cloud closer to a user with the help of a micro data center ( <inline-formula><tex-math notation="LaTeX">$mdc$</tex-math></inline-formula> ), leading to lower response times for delay sensitive applications. <i>RT-SANE</i> ( <u>R</u> eal- <u>T</u> ime <u>S</u> ecurity <u>A</u> ware scheduling on the <u>N</u> etwork <u>E</u> dge) supports batch and interactive applications, taking account of their deadline and security constraints. RT-SANE chooses between an <inline-formula><tex-math notation="LaTeX">$mdc$</tex-math></inline-formula> (in proximity to a user) and a cloud data center ( <inline-formula><tex-math notation="LaTeX">$cdc$</tex-math></inline-formula> ) by taking account of network delay and security tags. Jobs submitted by a user are tagged as: private, semi-private and public, and <inline-formula><tex-math notation="LaTeX">$mdcs$</tex-math></inline-formula> and <inline-formula><tex-math notation="LaTeX">$cdcs$</tex-math></inline-formula> are classified as: trusted, semi-trusted and untrusted. RT-SANE executes private jobs on a user’s local <inline-formula><tex-math notation="LaTeX">$mdcs$</tex-math></inline-formula> or pre-trusted <inline-formula><tex-math notation="LaTeX">$cdcs$</tex-math></inline-formula> , and semi-private and public jobs on remote <inline-formula><tex-math notation="LaTeX">$mdcs$</tex-math></inline-formula> and <inline-formula><tex-math notation="LaTeX">$cdcs$</tex-math></inline-formula> . A security and performance-aware distributed orchestration architecture and protocol is made use of in RT-SANE. For evaluation, workload traces from the CERIT-SC Cloud system are used. The effect of slow executing straggler jobs on the Fog framework are also considered, involving migration of such jobs. Experiments reveal that <i>RT-SANE</i> offers a higher “success ratio” (successfully completed jobs) to comparable algorithms, including consideration of security tags.

Reinforcement Learning for Security-Aware Workflow Application Scheduling in Mobile Edge Computing

Mobile edge computing as a novel computing paradigm brings remote cloud resource to the edge servers nearby mobile users. Within one-hop communication range of mobile users, a number of edge servers equipped with enormous computation and storage resources are deployed. Mobile users can offload their partial or all computation tasks of a workflow application to the edge servers, thereby significantly reducing the completion time of the workflow application. However, due to the open nature of mobile edge computing environment, these tasks, offloaded to the edge servers, are susceptible to be intentionally overheard or tampered by malicious attackers. In addition, the edge computing environment is dynamical and time-variant, which results in the fact that the existing quasistatic workflow application scheduling scheme cannot be applied to the workflow scheduling problem in dynamical mobile edge computing with malicious attacks. To address these two problems, this paper formulates the workflow scheduling problem with risk probability constraint in the dynamic edge computing environment with malicious attacks to be a Markov Decision Process (MDP). To solve this problem, this paper designs a reinforcement learning-based security-aware workflow scheduling (SAWS) scheme. To demonstrate the effectiveness of our proposed SAWS scheme, this paper compares SAWS with MSAWS, AWM, Greedy, and HEFT baseline algorithms in terms of different performance parameters including risk probability, security service, and risk coefficient. The extensive experiments results show that, compared with the four baseline algorithms in workflows of different scales, the SAWS strategy can achieve better execution efficiency while satisfying the risk probability constraints.

Security-Aware Dynamic Scheduling for Real-Time Optimization in Cloud-Based Industrial Applications

Nowadays, large number of cloud-based techniques have been used in industrial control systems (ICS), which also brings many security threats. The emergence of security-aware industrial control has paved the way of security-aware scheduling in cloud-based industrial applications. Actually, most cloud-based industrial applications are time sensitive, which need real-time processing. Edge cloud computing paradigm extends the computing ability of traditional cloud model with low-latency local resources. Thus, heterogeneous clouds that consist of both centralized resources and edge resources may be a promising resource model to provide both scalable and low-latency resources for cloud-based industrial applications. In view of these challenges, in this article, we propose a security-aware dynamic scheduling method for real-time resource allocation in ICS. First, a three-level security model is designed for both tasks and cloud resources in ICS, and a two-tier heterogeneous cloud architecture is introduced. Accordingly, a security-aware scheduling method based on distributed particle swarm optimization is presented for resource allocation with security concerns. To deal with the dynamics of edge resources and the mobility of mobile industrial applications, a dynamic scheduling mechanism based on dynamic workflow model is proposed for real-time optimization. Experimental results validate that the scheduling control policy proposed in this article can achieve a good balance between scheduling performance and security performance.

Security aware dynamic scheduling algorithm (SADSA) for real-time applications on grid

Security is a major concern of modern real-time applications, besides requiring stringent latency bound. However, encryption algorithms are computation intensive task which impacts the timeliness of the real-time applications. Therefore, there exists a trade-off between the desired level of security and the service guarantee. In this paper, we propose a security-aware dynamic scheduling algorithm (SADSA) using a grid of computational elements (CEs) which performs this trade-off and tries to maximize the instantaneous average security level of the packets besides providing a guaranteed service. As packets arrive, we first assign them to the CEs based on the utilization value of a CE, which is the ratio of completion time and a deadline of the last packet in a CE. The security level of all the packets is then dynamically adjusted to meet the minimum required security level while maximizing the average security level of all the packets in that CE. We first show that the proposed assignment algorithm is NP-hard, is 2-competitive to the optimal solution, and that the proposed algorithm provides a sub-optimal solution. Further, using extensive simulation, we show that the proposed SADSA algorithm performs better in terms of guarantee ratio, average security level and overall performance compared to the existing algorithms.

Anonymity-based intra–inter and multiple layer service dependent security-aware packet scheduling algorithm (AIIMLSDSPS)

ABSTRACTThe concept of anonymity is included for enhancing the efficiency of security aware packet scheduling by introducing, Anonymity-based Intra and inter and multiple layer service dependent security aware packet scheduling algorithm (AIIMLSDSPS). The anonymity of the source locations are often violated by the intruders through traffic analysis and RF localization techniques. The proposed fake source-location method produces the fake sources into the network in order to confuse the intruder. When the original sources send event messages with secured routing policy, the fake sources are generated dynamically. Fake sources then construct several fake paths in the network. Thus, the proposed fake source-location method minimizes the chances of intrusion and reduces the packet loss with minimal latency and reduced overhead. However, as number of fake paths and fake messages increases, energy consumption of each source is also increases.

A fuzzy energy and security aware scheduling in cloud

The cloud computing is the one that deals with the trading of the resources efficiently in accordance to the user’s need. A Job scheduling is the choice of an ideal resource for any job to be executed with regard to waiting time, cost or turnaround time. A cloud job scheduling will be an NP-hard problem that contains n jobs and m machines and every job is processed with each of these m machines to minimize the make span. The security here is one of the top most concerns in the cloud. In order to calculate the value of fitness the fuzzy inference system makes use of the membership function for determining the degree up to which the input parameters that belong to every fuzzy set is relevant. Here the fuzzy is used for the purpose of scheduling energy as well as security in the cloud computing.

Security-Aware Scheduling of Embedded Control Tasks

In this work, we focus on securing cyber-physical systems (CPS) in the presence of network-based attacks, such as Man-in-the-Middle (MitM) attacks, where a stealthy attacker is able to compromise communication between system sensors and controllers. Standard methods for this type of attacks rely on the use of cryptographic mechanisms, such as Message Authentication Codes (MACs) to ensure data integrity. However, this approach incurs significant computation overhead, limiting its use in resource constrained systems. Consequently, we consider the problem of scheduling multiple control tasks on a shared processor while providing a suitable level of security guarantees. Specifically, by security guarantees we refer to control performance, i.e., Quality-of-Control (QoC), in the presence of attacks. We start by mapping requirements for QoC under attack into constraints for security-aware control tasks that, besides standard control operations, intermittently perform data authentication. This allows for the analysis of the impact that security-related computation overhead has on both schedulability of control tasks and QoC. Building on this analysis, we introduce a mixed-integer linear programming-based technique to obtain a schedulable task set with predefined QoC requirements. Also, to facilitate optimal resource allocation, we provide a method to analyze interplay between available computational resources and the overall QoC under attack, and show how to obtain a schedulable task set that maximizes the overall QoC guarantees. Finally, we prove usability of our approach on a case study with multiple automotive control components.

TL-HLS: Methodology for Low Cost Hardware Trojan Security Aware Scheduling With Optimal Loop Unrolling Factor During High Level Synthesis

Security against hardware Trojan that is capable to change the computational output value is accomplished by employing dual modular redundant (DMR) schedule during high level synthesis (HLS). However, building a DMR for Trojan security is nontrivial and incurs extra delay and hardware. This paper proposes a novel HLS methodology for constraint driven low cost hardware Trojan secured DMR schedule design for loop-based control data flow graphs (CDFGs). Proposed approach simultaneously explores an optimal schedule and optimal loop unrolling factor (U) combination for a low cost Trojan security aware DMR schedule. As a specific example, proposed low cost Trojan secured HLS approach relies on particle swarm optimization algorithm to explore optimized Trojan secured schedule with optimal unrolling that provides security against specific Trojan (causing change in computational output) within user provided area and delay constraints. The novel contributions of this paper are, first an exploration of a low cost Trojan security aware HLS solution for loop-based CDFGs; second, proposed encoding scheme for representing design solution comprising candidate schedule resources, candidate loop unrolling factor and candidate vendor allocation information; third, a process for exploring the a low cost vendor assignment that provides Trojan security; finally, experimental results over the standard benchmark that indicates an average reduction in final cost of ~12% compared to recent approach.

Artificial Neural Network support to monitoring of the evolutionary driven security aware scheduling in computational distributed environments

Monitoring of the system performance in highly distributed computing environments is a wide research area. In cloud and grid computing, it is usually restricted to the utilization and reliability of the resources. However, in today’s Computational Grids (CGs) and Clouds (CCs), the end users may define the special personal requirements and preferences in the resource and service selection, service functionality and data access. Such requirements may refer to the special individual security conditions for the protection of the data and application codes. Therefore, solving the scheduling problems in modern distributed environments remains still challenging for most of the well known schedulers, and the general functionality of the monitoring systems must be improved to make them efficient as schedulers supporting modules.In this paper, we define a novel model of security-driven grid schedulers supported by an Artificial Neural Network (ANN). ANN module monitors the schedule executions and learns about secure task–machine mappings from the observed machine failures. Then, the metaheuristic grid schedulers (in our case—genetic-based schedulers) are supported by the ANN module through the integration of the sub-optimal schedules generated by the neural network, with the genetic populations of the schedules.The influence of the ANN support on the general schedulers’ performance is examined in the experiments conducted for four types of the grid networks (small, medium, large and very large grids), two security scheduling modes—risky and secure scenarios, and six genetic-based grid schedulers. The generated empirical results show the high effectiveness of such monitoring support in reducing the values of the major scheduling criteria (makespan and flowtime), the run times of the schedulers and the grid resource failures.

Data Intensive Dynamic Scheduling Model and Algorithm for Cloud Computing Security

As cloud is growing immensely, different types of data are getting more and more dynamic in terms of security. Ensuring high level of security for all data in storages is highly expensive and time consuming. Unsecured services on data are also becoming vulnerable for malicious threats and data leakage. The main reason for this is that, the traditional scheduling algorithms for executing different services on data stored in cloud usually sacrifice security privilege in order to achieve deadline. To provide adequate security without sacrificing cost and deadline for real time data- intensive cloud system, security aware scheduling algorithm has become an effective and important feature. Existing systems also merely provide efficient security aware scheduling and security for data. In order to ensure adequate security for different data storages in cloud, in this paper we have proposed a three tier security framework. We have analyzed mathematically the security overhead for different security services such as confidentiality, integrity as well as authenticity and shown that our framework can provide adequate level of security and enhance the processing speed of security services without taking additional overhead in time. We have also proposed a scheduling algorithm to ensure security for data intensive applications. The simulation results show that the proposed algorithm gives better success rate with adequate security in comparisons with existing algorithms. This algorithm ensures security of data and applications as well as confirms the job to be scheduled within deadline.

Real-Time Scheduling with Security Enhancement for Packet Switched Networks

Real-time network applications depend on schedulers to guarantee the quality of service (QoS). Conventional real-time schedulers focus on the timing constraints but are much less effective in satisfying the security requirements. In this paper, we propose an adaptive security-aware scheduling system for packet switched networks using a real-time multi-agent design model. The proposed system combines real-time scheduling with security service enhancement. The scheduling unit uses the differentiated-earliest-deadline-first (Diff-EDF) scheduler and the security enhancement scheme adopts a congestion control mechanism. The required QoS is guaranteed for different types (audio and video) of real-time data flows, while the packet security levels are adaptively enhanced according to the feedbacks from the congestion control module. Compared with the IPsec protocol, the proposed scheme reduces the number of pending packets at the destinations. In implementation, the proposed scheme can overload the priority code point and the virtual-LAN identifier fields of the IEEE 802.1Q frame format, hence eliminating the overhead of the security associations performed by the IPsec protocol.

CCBKE — Session key negotiation for fast and secure scheduling of scientific applications in cloud computing

Instead of purchasing and maintaining their own computing infrastructure, scientists can now run data-intensive scientific applications in a hybrid environment such as cloud computing by facilitating its vast storage and computation capabilities. During the scheduling of such scientific applications for execution, various computation data flows will happen between the controller and computing server instances. Amongst various quality-of-service (QoS) metrics, data security is always one of the greatest concerns to scientists because their data may be intercepted or stolen by malicious parties during those data flows, especially for less secure hybrid cloud systems. An existing typical method for addressing this issue is to apply the Internet Key Exchange (IKE) scheme to generate and exchange session keys, and then to apply these keys for performing symmetric-key encryption which will encrypt those data flows. However, the IKE scheme suffers from low efficiency due to its asymmetric-key cryptological operations over a large amount of data and high-density operations which are exactly the characteristics of scientific applications. In this paper, we propose Cloud Computing Background Key Exchange (CCBKE), a novel authenticated key exchange scheme that aims at efficient security-aware scheduling of scientific applications. Our scheme is designed based on the randomness-reuse strategy and the Internet Key Exchange (IKE) scheme. Theoretical analyses and experimental results demonstrate that, compared with the IKE scheme, our CCBKE scheme can significantly improve the efficiency by dramatically reducing time consumption and computation load without sacrificing the level of security.

An improved security-aware packet scheduling algorithm in real-time wireless networks

Developing security-aware packet scheduling algorithms can efficiently enhance the security while delivering packets through wireless links. Existing scheduling algorithms developed for real-time wireless networks provide security at the cost of other important performance, e.g., schedulability. The performance problem becomes especially apparent when wireless networks are heavily loaded. To address this issue, we propose in this paper an improved security-aware packet scheduling algorithm (or ISAPS in short) in wireless networks. ISAPS first gives high priority to deal with schedulability when the real-time system is heavily loaded. When the system is under light workload, ISAPS strives to improve the security levels while achieving high schedulability for real-time packets. Compared with the existing packet scheduling algorithm SPSS, ISAPS shows excellent scheduling quality under a wide range of workload characteristics.

Weight-balanced security-aware scheduling for real-time computational grid

Security-aware scheduling for real-time grid applications is an important task and a little work has been done to accomplish this. In this paper, we propose two scheduling algorithms for real-time grid applications with stringent security requirements, and the proposed algorithms are compared with a few existing scheduling algorithms, i.e. MinMin, MaxMin, EDF/ECT, SPMinMin and SPMaxMin. Security overhead computation for existing and proposed models is done on the basis of security level demand of the tasks. Performance of WB-EDFMin on success rate performance metric is considered to be the best among all the contemporary scheduling algorithms. SFWB-EDFMin compromises on the overall success rate of the grid application but its task scheduling is uniformly spread over the tasks of all security levels.

Improving security for periodic tasks in embedded systems through scheduling

While many scheduling algorithms for periodic tasks ignore security requirements posed by sensitive applications and are, consequently, unable to perform properly in embedded systems with security constraints, in this paper, we present an approach to scheduling periodic tasks in embedded systems subject to security and timing constraints. We design a necessary and sufficient feasibility check for a set of periodic tasks with security requirements. With the feasibility test in place, we propose a scheduling algorithm, or SASES (security-aware scheduling for embedded systems), which accounts for both security and timing requirements. SASES judiciously distributes slack times among a variety of security services for a set of periodic tasks, thereby optimizing security for embedded systems without sacrificing schedulability. To demonstrate the effectiveness of SASES, we apply the proposed SASES to real-world embedded systems such as an automated flight control system. We show, through extensive simulations, that SASES is able to maximize security for embedded systems while guaranteeing timeliness. In particular, SASES significantly improves security over three baseline algorithms by up to 107%.

Dynamic global security-aware synthesis using SystemC

A dynamic global security-aware synthesis flow using the SystemC language is presented. SystemC security models are first specified at the system or behavioural level using a library of SystemC behavioural descriptions which provide for the reuse and extension of security modules. At the core of the system is incorporated a global security-aware scheduling algorithm which allows for scheduling to a mixture of components of varying security level. The output from the scheduler is translated into annotated nets which are subsequently passed to allocation, optimisation and mapping tools for mapping into circuits. The synthesised circuits incorporate asynchronous secure power-balanced and fault-protected components. Results show that the approach offers robust implementations and efficient security/area trade-offs leading to significant improvements in turnover.

A Security Middleware Model for Real-Time Applications on Grids

Real-time applications are indispensable for conducting research and business in government, industry, and academic organizations. Recently, real-time applications with security requirements increasingly emerged in large-scale distributed systems such as Grids. However, the complexities and specialties of diverse security mechanisms dissuade users from employing existing security services for their applications. To effectively tackle this problem, in this paper we propose a security middleware (SMW) model from which security-sensitive real-time applications are enabled to exploit a variety of security services to enhance the trustworthy executions of the applications. A quality of security control manager (QSCM), a centerpiece of the SMW model, has been designed and implemented to achieve a flexible trade-off between overheads caused by security services and system performance, especially under situations where available resources are dynamically changing and insufficient. A security-aware scheduling mechanism, which plays an important role in QSCM, is capable of maximizing quality of security for real-time applications running in distributed systems as large-scale as Grids. Our empirical studies based on real world traces from a supercomputing center demonstratively show that the proposed model can significantly improve the performance of Grids in terms of both security and schedulability.