Acctee: A WebAssembly-based Two-way Sandbox for Trusted Resource Accounting - Goltzsche, David; Nieke, Manuel; Knauth, Thomas; Kapitza, Rüdiger (Middleware 2019 - Proceedings of the 2019 20th International Middleware Conference, 2019)
Remote computation has numerous use cases such as cloud computing, client-side web applications or volunteer computing. Typically, these computations are executed inside a sandboxed environment for two reasons: first, to isolate the execution in order to protect the host environment from unauthorised access, and second to control and restrict resource usage. Often, there is mutual distrust between entities providing the code and the ones executing it, owing to concerns over three potential problems: (i) loss of control over code and data by the providing entity, (ii) uncertainty of the integrity of the execution environment for customers, and (iii) a missing mutually trusted accounting of resource usage. In this paper we present AccTEE, a two-way sandbox that offers remote computation with resource accounting trusted by consumers and providers. AccTEE leverages two recent technologies: hardware-protected trusted execution environments, and WebAssembly, a novel platform independent byte-code format. We show how AccTEE uses automated code instrumentation for fine-grained resource accounting while maintaining confidentiality and integrity of code and data. Our evaluation of AccTEE in three scenarios – volunteer computing, serverless computing, and pay-by-computation for the web – shows a maximum accounting overhead of 10%.
CRIS-Team Scopus Importer:2022-07-19
Keywords: Intel SGX; Resource Accounting; Sandbox; Trusted Computing; WebAssembly

Adaptive and scalable high availability for infrastructure clouds - Brenner, Stefan; Garbers, Benjamin; Kapitza, Rüdiger (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), 2014)
These days Infrastructure-as-a-Service (IaaS) clouds attract more and more customers for their flexibility and scalability. Even critical data and applications are considered for cloud deployments. However, this demands for resilient cloud infrastructures. Hence, this paper approaches adaptive and scalable high availability for IaaS clouds. First, we provide a detailed failure analysis of OpenStack showing the impact of failing services to the cloud infrastructure. Second, we analyse existing approaches for making OpenStack highly available, and pinpoint several weaknesses of current best practice. Finally, we propose and evaluate improvements to automate failover mechanisms. © 2014 IFIP Internatinal Federation for Information Processing.
CRIS-Team Scopus Importer:2022-07-19
Keywords: Cloud Computing; Reliable

Adaptive Web Service Migration - Kapitza, Rüdiger; et al. (DAIS 2008, 2008)
In highly dynamic and heterogeneous environments such as mobile and ubiquitous computing, software must be able to adapt at runtime and react to the environment. Furthermore it should be independent of a certain hardware platform and implementation language. In this paper, we propose an infrastructure for self-adaptive migratable Web services (SAM-WS) for implementing applications for such environments. A SAM-WS supports stateful migration and adaptation to particular application context by being able to dynamically change the interface, locally available state and implementation in use. Despite adaptation and migration it maintains a unique ID during the whole life time. This allows clients to have a location-independent reference to a specific Web service instance. Although our prototype implementation is based on Apache Axis, the concept can be easily ported to any Web service framework without platform modifications. We provide an example application and performance measurements for different system platforms ranging from a standard device to resource-restricted mobile devices. © 2008 Springer-Verlag Berlin Heidelberg.
UnivIS-Import:2015-04-16:Pub.2008.tech.IMMD.IMMD4.adapti
Keywords: Adaptation; Migration; Web Service

A fast and secure key-value service using hardware enclaves - Messadi, Ines; Neumann, Shivananda; Almstedt, Lennart; Kapitza, Rüdiger (Middleware Demos and Posters 2019 - Proceedings of the 2019 20th International Middleware Conference Demos and Posters, Part of Middleware 2019, 2019)
Trusted execution as offered by Intel Software Guard Extensions (SGX) enables confidentiality and integrity for cloud-hosted services. While in principle all kinds of workloads can be secured using trusted execution, key-value stores have gained special attention as these services are an essential building block of most complex cloud deployments. So far the main design challenge has been to address current performance limitations of SGX. In addition, we identify the integration of SGX-guarded workloads with recent network technology, especially Remote Direct Memory Access (RDMA) as an upcoming requirement. RDMA allows fast direct access to remote memory at high bandwidth. However, SGX protected memory cannot be directly accessed over the network. Furthermore, due to the more powerful network, secured services might likely be CPU-bound as a result of the necessary cryptographic operations. In this paper, we present a new key-value store architecture that utilizes trusted execution to offer confidentiality and integrity, while using RDMA for low latency and high bandwidth communication. To prevent a server-side CPU bottleneck, clients pre-compute cryptographic operations when possible while data movement in and out of the trusted execution environment has been reduced to the bare minimum.
CRIS-Team Scopus Importer:2022-07-19
Keywords: Intel SGX; Key-value storage; Remote Direct Memory Access

A Flexible, Adaptive System for Data-Stream Processing in Energy-Constrained Ad-hoc Networks - Eibel, Christopher; Herbst, Sebastian; Cassens, Björn; Hönig, Timo; Wägemann, Peter; Janker, Heiko; Kapitza, Rüdiger; Meyer-Wegener, Klaus; Schröder-Preikschat, Wolfgang (2016)
Today's generation of sensor networks reflect several changes in system characteristics over traditional sensor networks. These changes affect three key aspects: energy as a fundamental resource, stream data processing, and the inherently dynamic structure of the overall system.   In this paper we extract and present eight distinct challenges aligned to the key aspects which need to be addressed in the future. We use data of ongoing science and research projects to extract the most important challenges. These challenges need to be tackled in order to provide the basis for a flexible and adaptive system design which supports data-stream processing in energy-constrained ad-hoc networks.

A Membership Service for a Distributed, Embedded System Based on a Time-Triggered FlexRay Network - Mitzlaff, Martin; Lang, Michael; Kapitza, Rüdiger; Schröder-Preikschat, Wolfgang (Proceedings of the Eight European Dependable Computing Conference, 2010)
The FlexRay bus system is the new de-facto standard for connecting electronic control units (ECUs) in cars. Because of its time-triggered message scheduling, it is regarded as the basis for applications like drive-by-wire. In order to fulfill the associated safety requirements, a reliable membership service is mandatory for providing consensus on all fault-free nodes. However, the FlexRay specification misses to define such a service. Consequently, it is not a part of the communication controllers but has to be realized in the software that is executed by the ECUs. This paper proposes a membership protocol especially tailored for FlexRay-based distributed systems such as envisioned by the AUTomotive Open System ARchitecture (AUTOSAR) standard. It features low runtime overhead and imposes small scheduling restrictions on the ECU. We have verified the correctness of the main characteristics of the protocol by means of model checking and have practically evaluated it in a cluster of common automotive microcontrollers. © 2010 IEEE.
UnivIS-Import:2015-04-16:Pub.2010.tech.IMMD.IMMD4.amembe
Keywords: Fault Tolerance; Distributed and Embedded Systems; Membership; Algorithm/Protocol Design and Analysis; Automotive; FlexRay; AUTOSAR

AOCI: An Aspect-Oriented Component Infrastructure - Söldner, Guido; Kapitza, Rüdiger (Proceedings of the 12th International Workshop on Component Oriented Programming (WCOP 2007), 2007)
UnivIS-Import:2015-04-16:Pub.2007.tech.IMMD.IMMD4.aocian

AOCI: Ontology-based Pointcuts - Söldner, Guido; Kapitza, Rüdiger; et al. (Proceedings of the 8th AOSD Workshop on Aspects, Components, and Patterns for Infrastructure Software (AOSD-ACP4IS '09), 2009)
In this paper, we propose ontology-based pointcuts, a novel mechanism based on the ideas of AOP, the separation of concerns and system modularization, to enhance components, thus making them more adaptable and evolvable. The core idea of ontologybased pointcuts is to specify pointcuts in terms of ontological concepts instead of patterns that are matched against source code. Components are usually considered as black boxes that can be combined to a complex system using their outer interfaces. In the context of our infrastructure, components are extended by exporting possible adaptation points, which are enriched by ontological information. This ontological metadata represents concepts from a domain model, defined by a domain expert. The ontology is implemented within an intermediate layer that decouples the matching pointcuts from the concrete source level within the components. This enables the application of AOP techniques without detailed knowledge about the component's internals, enabling dynamic and distributed adaptation and reducing the fragile pointcut problem to the component scope. This paper presents the design and the expressiveness of the ontology-based pointcuts. We show several practical examples how to use joinpoint model and the pointcut specification followed by a short discussion. Copyright 2009 ACM.
UnivIS-Import:2015-04-16:Pub.2009.tech.IMMD.IMMD4.aocion
Keywords: dynamic adaptation; metadata-driven adaptation; osgi

AOCI: Weaving Components in a Distributed Environment - Söldner, Guido; Schröder-Preikschat, Wolfgang; Kapitza, Rüdiger; et al. (On the Move to Meaningful Internet Systems 2008: CoopIS, DOA, ODBASE, GADA, and IS, 2008)
Mobile and embedded devices like PDAs, mobile phones, and all kinds of consumer hardware populate the world we live in. Despite the vision of ubiquitous computing and its idea of spontaneous interaction among these devices more than fifteen years ago, most of them are still isolated and restricted in their interaction capabilities. One reason for this limitation is the poor support for dynamic adaptation and evolution of software in distributed environments. This paper proposes AOCI, an Aspect-Oriented Component Infrastructure that takes the core ideas of AOP, the separation of concerns and system modularization to make them more adaptable and evolvable, to the domain of component systems. Components are usually considered as black boxes that can be combined to a complex system using their outer interfaces. In the context of our infrastructure, components export possible adaptation points, which are enriched by ontological information. This enables the application of AOP techniques without detailed knowledge about the component's internals, enabling dynamic and distributed adaptation. Our prototype is based on OSGi and provides a complete infrastructure to weave local as well as remote components. We demonstrate the feasibility of our approach by adapting the RUBiS infrastructure (a web-based bidding system) to support dynamic user-centric error detection. © 2008 Springer Berlin Heidelberg.
UnivIS-Import:2015-04-16:Pub.2008.tech.IMMD.IMMD4.aociwe

AsyncShock: Exploiting synchronisation bugs in intel SGX enclaves - Weichbrodt, Nico; Kurmus, Anil; Pietzuch, Peter; Kapitza, Rüdiger (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), 2016)
Intel’s Software Guard Extensions (SGX) provide a new hardware-based trusted execution environment on IntelCPUs using secure enclaves that are resilient to accesses by privileged code and physical attackers. Originally designed for securing small services, SGX bears promise to protect complex, possibly cloud-hosted, legacy applications. In this paper, we show that previously considered harmless synchronisation bugs can turn into severe security vulnerabilities when using SGX. By exploiting use-after-free and time-of-check-to-time-of-use (TOCTTOU) bugs in enclave code, an attacker can hijack its control flowor bypass access control. We present AsyncShock, a tool for exploiting synchronisation bugs of multithreaded code running under SGX.AsyncShock achieves this by only manipulating the scheduling of threads that are used to execute enclave code. It allows an attacker to interrupt threads by forcing segmentation faults on enclave pages. Our evaluation using two types of Intel Skylake CPUs shows that AsyncShock can reliably exploit use-after-free and TOCTTOU bugs.
CRIS-Team Scopus Importer:2022-07-19
Keywords: Intel software guard extensions (SGX); Synchronisation; Threading; Vulnerability

Attack Surface Metrics and Automated Compile-Time OS Kernel Tailoring - Kurmus, Anil; Tartler, Reinhard; Dorneanu, Daniela; Heinloth, Bernhard; Rothberg, Valentin; Ruprecht, Andreas; Schröder-Preikschat, Wolfgang; Lohmann, Daniel; Kapitza, Rüdiger (Proceedings of the 20th Network and Distributed System Security Symposium (NDSS '13), 2013)
UnivIS-Import:2015-04-16:Pub.2013.tech.IMMD.IMMD4.attack
Keywords: VAMOS; Configurability; System Software; Software Engineering; Maintenance; Security

Attack surface reduction for commodity OS kernels: Trimmed garden plants may attract less bugs - Kurmus, Anil; Sorniotti, Alessandro; Kapitza, Rüdiger (Proceedings of the 4th Workshop on European Workshop on System Security, EUROSEC'11, 2011)
Kernel vulnerabilities are a major current practical security problem, as attested by the weaknesses and flaws found in many commodity operating system kernels in recent years. Ever-growing code size in those projects, due to the addition of new features and the reluctance to remove legacy support, indicate that this problem will remain a severe system security threat in the foreseeable future. Reactive measures such as bug fixes via code reviews and testing, while effective, can only alleviate the issue. Furthermore, common practices in system hardening often focus on complex and sometimes hard to achieve goals that require extensive manual intervention such as security policies for sandboxing. In this paper, we explore an alternative, automated and effective way of reducing the attack surface in commodity operating system kernels, which we call trimming. Trimming is a two-fold process: an initial analysis of a given system for unused kernel code sections is followed by an enforcement phase, in which the unused sections are removed or prevented from being executed. We discuss the requirements that should be reflected in the design of a trimming infrastructure, and present a lightweight and flexible implementation example for the Linux kernel by using dynamic binary instrumentation as provided by kprobes. Our evaluations show we can, in the case of a web server, reduce the attack surface of the kernel (in terms of the number of kernel functions accessible from unprivileged users) by about 88%. Copyright © 2011 ACM.
CRIS-Team Scopus Importer:2022-07-19

Automated Application of Fault Tolerance Mechanisms in a Component-Based System - Stilkerich, Isabella; Stilkerich, Michael; Kapitza, Rüdiger; Lohmann, Daniel; Schröder-Preikschat, Wolfgang (Proceedings of the 9th International Workshop on Java Technologies for Real-Time and Embedded Systems, 2011)
Due to the reduction of structure sizes in modern embedded systems, tolerating soft errors presenting itself as bit flips becomes a mandatory task even for moderate critical applications. Accordingly, software-based fault tolerance mechanisms recently gained in popularity and a multitude of approaches that differ in the number and frequency of tolerated errors as well as their associated overhead have been proposed. As a consequence, an application- and environment-tailored selection of mechanisms is required to balance protection and costs. Accounting the diverse solution space, we propose to make software-based fault tolerance a matter of configuration that should be transparent to the applications. While this would be cumbersome when using an unsafe programming language, we show that in the context of KESO, a JVM for deeply embedded systems, this can be achieved by utilizing the Java type system and static code analysis. As an initial technique we decided to add redundant execution to KESO, which enables us to selectively and transparently replicate an application. This essentially builds a first step to a JVM, which offers reliable execution of components as demanded by the system configuration. © 2011 ACM.
UnivIS-Import:2015-04-16:Pub.2011.tech.IMMD.IMMD4.automa
Keywords: Java; embedded systems; fault tolerance; TMR; KESO; DanceOS

Automated encounter detection for animal-borne sensor nodes - Cassens, Björn; Ripperger, Simon; Hierold, Martin; Mayer, Frieder; Kapitza, Rüdiger (International Conference on Embedded Wireless Systems and Networks, 2017)
Tracking animals is mandatory for a better understanding of their social interactions. Social behavior of bats is of particular interest, since it can be used for improved epidemic avoidance and forecasts. Animal-borne sensor nodes are enabling the monitoring and analyzing the social contacts. Attached to bats, these nodes can only be equipped with small batteries, dictating tight requirements regarding the energy demand of the soft-and hardware infrastructure. In this paper, we present our software architecture of a wireless sensor network that allows a fully-automated tracking of the social behavior of free ranging animals. This software was extensively tested during a two month lasting field test in the tropical rain forest of Panama, thereby monitoring 38 free-ranging bats. We documented more than 300,000 biologically relevant events, generated by animal-borne sensor nodes running up to 15 days. Furthermore, we support runtime reconfiguration, allowing to adapt the system during campaigns without disturbing the animals. Showcasing that our system and especially the software works under realistic conditions, we give an in-depth insight of our experience during the field test.
CRIS-Team Scopus Importer:2022-07-19
Keywords: Animal tracking; Energy aware systems; Firmware; Wearable; Wireless sensor networks

Automatic OS Kernel TCB Reduction by Leveraging Compile-Time Configurability - Tartler, Reinhard; Kurmus, Anil; Heinloth, Bernhard; Rothberg, Valentin; Ruprecht, Andreas; Dorneanu, Daniela; Kapitza, Rüdiger; Schröder-Preikschat, Wolfgang; Lohmann, Daniel (Proceedings of the 8th Workshop on Hot Topics in System Dependability (HotDep '12), 2012)
The Linux kernel can be a threat to the dependability of systems because of its sheer size. A simple approach to produce smaller kernels is to manually configure the Linux kernel. However, the more than 11000 configuration options available in recent Linux versions render this a demanding task. We report on designing and implementing the first automated generation of a workload-tailored kernel configuration and discuss the security gains such an approach offers in terms of reduction of the Trusted Computing Base (TCB) size. Our results show that the approach prevents the inclusion of 10% of functions known to be vulnerable in the past.<br
UnivIS-Import:2015-04-16:Pub.2012.tech.IMMD.IMMD4.automa_0
Keywords: VAMOS; Configurability; System Software; Software Engineering; Maintenance; Security

Autonomous maneuver coordination via vehicular communication - Xu, Wenbo; Willecke, Alexander; Wegner, Martin; Wolf, Lars; Kapitza, Rüdiger (Proceedings - 49th Annual IEEE/IFIP International Conference on Dependable Systems and Networks Workshop, DSN-W 2019, 2019)
Autonomous vehicles can make local decisions based on the perception of their environments. However, individual decisions do not always result in the most efficient solution from a global point of view, because of a lack of coordination. To improve the traffic efficiency, multiple autonomous vehicles can be orchestrated in a spontaneous group. This is achieved by a recently proposed Maneuver Coordination service utilizing the vehicular communication. Vehicles equipped with the Maneuver Coordination service can share their planned driving trajectories with others close to them, detect potential conflicts and negotiate a new plan of trajectories. If the negotiation is successful, the vehicles can end up with a cooperative and more efficient joint plan, compared to the individual plans. In this work, we extend the Maneuver Coordination service by designing a coordination protocol for the negotiation. Our protocol can ensure an agreement and prevent conflicting maneuver changes. The negotiation procedure also takes potential network failures into account and keeps the impact of such failures at a relatively low level. We tested our approach on a V2X simulation framework. The evaluation results of a lane-join scenario show that the coordinated plan after negotiation has 50% less accumulated time loss compared to the default right-of-way rules.
CRIS-Team Scopus Importer:2022-07-19
Keywords: Autonomous Driving; Cooperative Driving; Vehicular Communication

Bandwidth prediction in the face of asymmetry - Schober, Sven; Brenner, Stefan; Hauck, Franz J.; Kapitza, Rüdiger (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), 2013)
An increasing number of networked applications, like video conference and video-on-demand, benefit from knowledge about Internet path measures like available bandwidth. Server selection and placement of infrastructure nodes based on accurate information about network conditions help to improve the quality-of-service of these systems. Acquiring this knowledge usually requires fully-meshed ad-hoc measurements. These, however, introduce a large overhead and a possible delay in communication establishment. Thus, prediction-based approaches like Sequoia have been proposed, which treat path properties as a semimetric and embed them onto trees, leveraging labelling schemes to predict distances between hosts not measured before. In this paper, we identify asymmetry as a cause of serious distortion in these systems causing inaccurate prediction. We study the impact of asymmetric network conditions on the accuracy of existing tree-embedding approaches, and present direction-aware embedding, a novel scheme that separates upstream from downstream properties of hosts and significantly improves the prediction accuracy for highly asymmetric datasets. This is achieved by embedding nodes for each direction separately and constraining the distance calculation to inversely labelled nodes. We evaluate the effectiveness and trade-offs of our approach using synthetic as well as real-world datasets. © 2013 IFIP International Federation for Information Processing.
CRIS-Team Scopus Importer:2022-07-19
Keywords: Asymmetric bandwidth prediction; tree embedding

BATS: Adaptive Ultra Low Power Sensor Network for Animal Tracking - Duda, Niklas; Nowak, Thorsten; Hartmann, Markus; Schadhauser, Michael; Cassens, Björn; Wägemann, Peter; Nabeel, Muhammad; Ripperger, Simon; Herbst, Sebastian; Meyer-Wegener, Klaus; Mayer, Frieder; Dressler, Falko; et al. (Sensors, 2018)
In this paper, the BATS project is presented which aims to track the behavior of bats via an ultra-low power wireless sensor network. An overview about the whole project and its parts like sensor node design, tracking grid and software infrastructure is given and the evaluation of the project is shown. The BATS project includes a lightweight sensor node that is attached to bats and combines multiple features. Communication among sensor nodes allows tracking of bat encounters. Flight trajectories of individual tagged bats can be recorded at high spatial and temporal resolution by a ground node grid. To increase the communication range the BATS project implemented a long-range telemetry system to still receive sensor data outside the standard ground node network. The whole system is designed with the common goal of ultra-low energy consumption while still maintaining optimal measurement results. To this end, the system is designed in a flexible way and is able to adapt its functionality according to the current situation. In this way it uses the energy available on the sensor node as efficient as possible. <br
Keywords: wireless sensor networks; animal tracking; adaptive sensor network

BFT-Dep: Automatic deployment of byzantine fault-tolerant services in PaaS cloud - Li, Bijun; Kapitza, Rüdiger (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), 2016)
Cloud computing has been a massive trend over the recent years and eased the deployment of scalable distributed applications. While initially renting out virtual machines was the predominant form of cloud computing, nowadays Platform as a Service (PaaS) solutions are emerging. The main advantages of the latter are a faster and easier application deployment as well as built-in support for horizontal scalability. However, when it comes to services with more demanding dependability requirements, currently provided deployment mechanisms quickly become insufficient, forcing cloud customers to fall back into manual, selfmade strategies. In this paper, we present BFT-Dep, a framework for deploying Byzantine fault-tolerant (BFT) services in a PaaS cloud automatically. BFT-Dep leverages the existing PaaS functionality to address specific deployment requirements and provides tailored support to set up and manage replicated services. It flexibly integrates BFT protocols as an independent service layer, thereby alleviating the complexity that the deployment of such systems entails. An initial prototype of BFT-Dep has been implemented on top of the open-source PaaS platform Open- Shift and a first evaluation shows its practicability.
CRIS-Team Scopus Importer:2022-07-19
Keywords: Automatic application deployment; Byzantine fault tolerance; Platform as a service (PaaS) cloud

Bloxy: Providing transparent and generic BFT-based ordering services for blockchains - Ruesch, Signe; Bleeke, Kai; Kapitza, Rüdiger (Proceedings of the IEEE Symposium on Reliable Distributed Systems, 2019)
With the wide-spread use of blockchain technology, Byzantine fault-tolerant (BFT) protocols are explored as a means to achieve consensus on which transactions should be processed next. BFT protocols are not a one-size-fits-all solution: they should be chosen according to the blockchain's use case, which can range from supply chain management to decentralised storage, requiring specialisation e.g. regarding throughput, latency, or level of decentralisation. Previously, consensus protocols were usually hardcoded into the blockchain infrastructure and could not be exchanged, therefore inhibiting flexible use of an otherwise generic blockchain infrastructure. Hyperledger Fabric claims to provide modular consensus and support for crash-fault and Byzantine fault tolerant protocols. However, integrating a BFT protocol has shown that Fabric's architecture is currently not well-suited for this fault model as it requires substantial changes and thereby breaks Fabric's modularity. This also has to be repeated for each integrated BFT protocol. In this paper, we present Bloxy, a blockchain-aware trusted proxy running on the replica that encapsulates all BFT client functionality. Bloxy enables transparent access to generic BFT frameworks and preserves Fabric's modularity even for the Byzantine fault model. It runs inside a trusted execution environment based on Intel's Software Guard Extensions. Bloxy offers blockchain-specific communication mechanisms as well as short-term block storage to handle crashes or disconnects to ensure that all nodes receive block updates. We implemented two Bloxy-based ordering services based on PBFT and the hybrid BFT protocol Hybster. Our evaluation shows that our approach increases throughput by up to 71% compared to directly integrated BFT protocols.
CRIS-Team Scopus Importer:2022-07-19
Keywords: Blockchain; Byzantine fault tolerance; Hyperledger fabric

Bloxy: Providing Transparent and Generic BFT-Based Ordering Services for Blockchains - Schwarz-Rüsch, Signe; Bleeke, Kai; Kapitza, Rüdiger (38th International Symposium on Reliable Distributed Systems (SRDS 2019), 2019)
With the wide-spread use of blockchain technology, Byzantine fault-tolerant (BFT) protocols are explored as a means to achieve consensus on which transactions should be processed next. BFT protocols are not a one-size-fits-all solution: they should be chosen according to the blockchain’s use case, which can range from supply chain management to decentralised storage, requiring specialisation e. g. regarding throughput, latency, or level of decentralisation. Previously, consensus protocols were usually hardcoded into the blockchain infrastructure and could not be exchanged, therefore inhibiting flexible use of an otherwise generic blockchain infrastructure. Hyperledger Fabric claims to provide modular consensus and support for crash-fault and Byzantine fault tolerant protocols. However, integrating a BFT protocol has shown that Fabric’s architecture is currently not well-suited for this fault model as it requires substantial changes and thereby breaks Fabric’s modularity. This also has to be repeated for each integrated BFT protocol. In this paper, we present Bloxy, a blockchain-aware trusted proxy running on the replica that encapsulates all BFT client functionality. Bloxy enables transparent access to generic BFT frameworks and preserves Fabric’s modularity even for the Byzantine fault model. It runs inside a trusted execution environment based on Intel’s Software Guard Extensions. Bloxy offers blockchain-specific communication mechanisms as well as short-term block storage to handle crashes or disconnects to ensure that all nodes receive block updates. We implemented two Bloxy-based ordering services based on PBFT and the hybrid BFT protocol Hybster. Our evaluation shows that our approach increases the throughput of the ordering component by up to 71 % compared to directly integrated BFT protocols.<br
Keywords: Byzantine fault tolerance; Blockchain; Hyperledger Fabric

Bursting: Increasing Energy Efficiency of Erasure-Coded Data in Animal-Borne Sensor Networks - Cassens, Björn; Hartmann, Markus; Nowak, Thorsten; Duda, Niklas; Thielecke, Jörn; Kölpin, Alexander; Kapitza, Rüdiger (ESWN 2019, 2019)
Observing the (social) behavior of animals and especially bats contributes to improved epidemic forecasts and improved protection of rare or endangered species. For this task, animal-borne sensor nodes are powerful tools since they allow collecting more information at less influence to the species compared to traditional radio telemetry. However, as bats are inherently small vertebrates, a strict weight limit of 2 g is dictated for attached sensor nodes. To acquire enough data, the sensor nodes must achieve a runtime of at least two weeks, which demands a rigorous energy management. As the data transmission is the most energy hungry task, minimizing the energy demand in this segment is a key to achieve the desired runtimes. In this paper we present a novel technique that enables bursts of erasure coded data without sacrificing reliability (in a wildlife setting). To keep data losses at a minimum, our approach exploits the characteristics of the erasure channel and combines encoded packets in smart way. We evaluated this approach extensively with experiments, field tests and a theoretical analysis. The results show a decreased energy demand by 30.177 % to 36.951 % while the data rate is increased up to a factor of 4 at the same tim

Byzantine Agreement Service for Cooperative Wireless Embedded Systems - Xu, Wenbo; Wegner, Martin; Wolf, Lars; Kapitza, Rüdiger (Proceedings - 47th Annual IEEE/IFIP International Conference on Dependable Systems and Networks Workshops, DSN-W 2017, 2017)
Recently there is a number of scenarios such as vehicle platooning, UAV swarms and cooperative robots, where a group of autonomous entities needs to make joint decisions to operate effectively. Distributed agreement protocols can play a key role to establish a common view on context parameters and to coordinate joint actions. Due to the harsh environmental conditions in some of these scenarios and their safety critical nature such protocols need to tolerate arbitrary faults and even malicious attacks.This paper presents a framework for Byzantine fault tolerant agreement for small-sized groups of autonomous, wirelessly connected systems. It focuses, besides providing support for general purpose value agreement, on the agreement of distributed sensor readings. The latter enables to establish a joint view on context conditions, thereby building the basis for joint coordinated actions. As classical Byzantine fault tolerant agreement protocols require 3t + 1 participants to tolerate t faulty nodes, we also consider a hybrid fault model by utilizing a trusted subsystem, which can only be subject to crashes. The latter reduces the required group size for agreement to 2t + 1 nodes and reduces the message complexity of the protocol, which is essential for the targeted scenarios. The experiment results show that the trusted subsystem can effectively increase the efficiency.
CRIS-Team Scopus Importer:2022-07-19
Keywords: Byzantine fault tolerance; distributed agreement; wireless embedded system

CheapBFT: Resource-efficient Byzantine Fault Tolerance - Kapitza, Rüdiger; Behl, Johannes; Cachin, Christian; Distler, Tobias; Kuhnle, Simon; Mohammadi, Seyed Vahid; Schröder-Preikschat, Wolfgang; Stengel, Klaus (Proceedings of the EuroSys 2012 Conference (EuroSys '12), 2012)
One of the main reasons why Byzantine fault-tolerant (BFT) systems are not widely used lies in their high resource consumption: 3f + 1 replicas are necessary to tolerate only f faults. Recent works have been able to reduce the minimum number of replicas to 2f + 1 by relying on a trusted subsystem that prevents a replica from making conflicting statements to other replicas without being detected. Nevertheless, having been designed with the focus on fault handling, these systems still employ a majority of replicas during normal-case operation for seemingly redundant work. Furthermore, the trusted subsystems available trade off performance for security; that is, they either achieve high throughput or they come with a small trusted computing base. This paper presents CheapBFT, a BFT system that, for the first time, tolerates that all but one of the replicas active in normal-case operation become faulty. CheapBFT runs a composite agreement protocol and exploits passive replication to save resources; in the absence of faults, it requires that only f + 1 replicas actively agree on client requests and execute them. In case of suspected faulty behavior, CheapBFT triggers a transition protocol that activates f extra passive replicas and brings all non-faulty replicas into a consistent state again. This approach, for example, allows the system to safely switch to another, more resilient agreement protocol. CheapBFT relies on an FPGA-based trusted subsystem for the authentication of protocol messages that provides high performance and comprises a small trusted computing base. © 2012 AC
UnivIS-Import:2015-04-16:Pub.2012.tech.IMMD.IMMD4.cheapb
Keywords: TCLOUDS; REFIT

Cloud safety net: Detecting data leakage between cloud tenants - Priebe, Christian; Muthukumaran, Divya; O'Keeffe, Dan; Eyers, David; Shand, Brian; Pietzuch, Peter; Kapitza, Rüdiger (Proceedings of the ACM Conference on Computer and Communications Security, 2014)
When tenants deploy applications under the control of third-party cloud providers, they must trust the provider's security mechanisms for inter-tenant isolation, resource sharing and access control. Despite a provider's best efforts, accidental data leakage may occur due to misconfigurations or bugs in the cloud platform. Especially in Platform-as-a-Service (PaaS) clouds, which rely on weaker forms of isolation, the potential for unnoticed data leakage is high. Prior work to raise tenants' trust in clouds relies on attestation, which limits the management flexibility of providers, or fine-grained data tracking, which has high overheads. We describe CloudSafetyNet (CSN), a lightweight monitoring framework that gives tenants visibility into the propagation of their application data in a cloud environment with low performance overhead. It exploits the incentive of tenants to co-operate with each other to detect accidental data leakage. CSN transparently adds opaque security tags to a subset of form fields in HTTP requests, using a client-side JavaScript library. Socket-level monitors maintain a log of observed tags flowing between application components. Tenants retrieve their logs and identify foreign tags that indicate data leakage. To check the correct operation of CSN, tenants send probe requests with known tags and verify that monitors are logging correctly. Using an implementation of CSN deployed on the OpenShift and AppScale PaaS platforms, we show that it can discover misconfigurations and bugs with a negligible performance impact.
CRIS-Team Scopus Importer:2022-07-19
Keywords: Cloud; Data leakage detection; Inter-tenant isolation; Socket-level monitoring

Consensus-Oriented Parallelization: How to Earn Your First Million - Behl, Johannes; Distler, Tobias; Kapitza, Rüdiger (Proceedings of the 16th Middleware Conference (Middleware '15), 2015)
UnivIS-Import:2015-10-26:Pub.2015.tech.IMMD.IMMD4.consen
Keywords: REFIT

Consistent Replication of Multithreaded Distributed Objects - Kapitza, Rüdiger; Schröder-Preikschat, Wolfgang; et al. (Proc. of the IEEE Symp. on Reliable Distrib. Sys., 2006)
Determinism is mandatory for replicating distributed objects with strict consistency guarantees. Multithreaded execution of method invocations is a source of nondeterminism, but helps to improve performance and avoids deadlocks that nested invocations can cause in a single-threaded execution model. This paper contributes a novel algorithm for deterministic thread scheduling based on the interception of synchronisation statements. It assumes that shared data are protected by mutexes and client requests are sent to all replicas in total order; requests are executed concurrently as long as they do not issue potentially conflicting synchronisation operations. No additional communication is required for granting locks in a consistent order in all replicas. In addition to reentrant mutex locks, the algorithm supports condition variables and time-bounded wait operations. An experimental evaluation shows that, in some typical usage patterns of distributed objects, the algorithm is superior to other existing approaches. © 2006 IEEE.
UnivIS-Import:2015-04-16:Pub.2006.tech.IMMD.IMMD4.consis

CONTRACTBOX: Realizing accountable data sharing on the edge using a small scale blockchain - Almstedt, Lennart; Bleeke, Kai; Mahhouk, Mohammad; Jehl, Leander; Kapitza, Rüdiger; Wolf, Lars (Computer Networks, 2023)
The utilization of IoT devices is becoming omnipresent in industrial settings. However, adoption in more rural areas still poses challenges. Especially when processing data on the edge, privacy, data integrity, accountability and data ownership pose challenges since the devices may be easily accessed and manipulated. We present CONTRACTBOX, a system that provides accountable and trusted data sharing based on a publisher–subscriber system, as well as trusted computing on the edge. CONTRACTBOX uses a Trusted Execution Environment to guarantee the confidentiality and integrity of clients’ data and code. Furthermore, it provides security by using WebAssembly to execute the smart contracts in their own sandboxed environment. This design protects the host as well as co-located smart contracts from misbehaving executions. Lastly, it ensures the immutability and accountability of the published data by storing it in a blockchain. We show that CONTRACTBOX can process several thousand publications per second with various payloads and host multiple smart contract runtimes on a single edge device. CONTRACTBOX also achieves up to 35 times higher throughput than a comparable deployment of Hyperledger Fabric.
CRIS-Team Scopus Importer:2023-05-05
Keywords: Blockchain; Smart contract; Trusted Execution; WebAssembly

CrossCheck: A Holistic Approach for Tolerating Crash-Faults and Arbitrary Failures - Martens, Arthur; Borchert, Christoph; Nieke, Manuel; Spinczyk, Olaf; Kapitza, Rüdiger (Proceedings - 2016 12th European Dependable Computing Conference, EDCC 2016, 2016)
High availability is no longer optional since more and more Internet-based services provide economical or otherwise critical offerings. Traditionally, crash faults are addressed using state-machine replication (SMR) and critical data is selectively protected by checksums. Both techniques can be efficiently combined, however, large parts of a service remain susceptible to transient errors such as bit-flips or more severe state corruptions. To address this weakness and also to reduce the labouring and non-trivial effort of identifying and selectively hardening a complex service, we propose CrossCheck - A holistic approach. CrossCheck extends the crash-fault protection of SMR to also provide tolerance against arbitrary state corruptions, thereby especially addressing multithreaded applications. This is achieved by a fine-grained state comparison and a precise recovery mechanism using fault-free replicas. The implementation utilizes aspectoriented programming and therefore requires only minimal manual changes to the underlying software. In our evaluation, we show that a multithreaded key-value store can be made resilient to crashes and hardened against arbitrary state corruptions with moderate overhead.
CRIS-Team Scopus Importer:2022-07-19
Keywords: availability; client-server systems; fault tolerance; Multicore processing

Crosscheck: Hardening replicated multithreaded services - Martens, Arthur; Borchert, Christoph; Geissler, Tobias Oliver; Lohmann, Daniel; Spinczyk, Olaf; Kapitza, Rüdiger (Proceedings of the International Conference on Dependable Systems and Networks, 2014)
State-machine replication has received widespread attention for the provisioning of highly available services in data centers. However, current production systems focus on tolerating crash faults only and prominent service outages caused by state corruptions have indicated that this is a risky strategy. In the future, state corruptions due to transient faults (such as bit flips) become even more likely, caused by ongoing hardware trends regarding the shrinking of structure sizes and reduction of operating voltages. In this paper we present Crosscheck, an approach to tolerate arbitrary state corruption (ASC) in the context of fault-tolerant replication of multithreaded services. Crosscheck is able to detect silent data corruptions ahead of execution, and by crosschecking state changes with co-executing replicas, even ASCs can be detected. Finally, fault tolerance is achieved by a fine-grained recovery using fault-free replicas. Our implementation is transparent to the application by utilizing fine-grained software-hardening mechanisms using aspect-oriented programming. To validate Crosscheck we present a replicated multithreaded key-value store that is resilient to state corruptions.
CRIS-Team Scopus Importer:2022-07-19
Keywords: AspectC++; Determinism; Multithreading; Replication; Software Error Hardening

CYCLOSA: Decentralizing private web search through SGX-Based browser extensions - Pires, Rafael; Goltzsche, David; Ben Mokhtar, Sonia; Bouchenak, Sara; Boutet, Antoine; Felber, Pascal; Pasin, Marcelo; Schiavoni, Valerio; Kapitza, Rüdiger (Proceedings - International Conference on Distributed Computing Systems, 2018)
By regularly querying Web search engines, users (unconsciously) disclose large amounts of their personal data as part of their search queries, among which some might reveal sensitive information (e.g. health issues, sexual, political or religious preferences). Several solutions exist to allow users querying search engines while improving privacy protection. However, these solutions suffer from a number of limitations: some are subject to user re-identification attacks, while others lack scalability or are unable to provide accurate results. This paper presents CYCLOSA, a secure, scalable and accurate private Web search solution. CYCLOSA improves security by relying on trusted execution environments (TEEs) as provided by Intel SGX. Further, CYCLOSA proposes a novel adaptive privacy protection solution that reduces the risk of user re-identification. CYCLOSA sends fake queries to the search engine and dynamically adapts their count according to the sensitivity of the user query. In addition, CYCLOSA meets scalability as it is fully decentralized, spreading the load for distributing fake queries among other nodes. Finally, CYCLOSA achieves accuracy of Web search as it handles the real query and the fake queries separately, in contrast to other existing solutions that mix fake and real query results.
CRIS-Team Scopus Importer:2022-07-19
Keywords: Intel SGX; Privacy; Web search

Decentralised Dynamic Code Management for OSGi - Kapitza, Rüdiger; et al. (Proceedings of the Sixth MiNEMA workshop, 2008)
Originally designed for the management of network-attached devices OSGi builds a de-facto standard to modularise all kinds of complex Java applications. It enables deployment and updating of components, which are called bundles, by supporting automatic resolution of inter-component dependencies. Despite these benefits the OSGi specification omits dedicated support for discovery, selection and loading of locally unavailable bundles. However, this is a key requirement for large distributed applications especially in dynamic and heterogeneous environments. Current solutions are server-based and provide a central bundle repository thereby representing a single point of failure. Furthermore, these approaches lack support for automatic bundle selection based on non-functional properties such as resource demand or performance. We introduce the D 2CM infrastructure accounting these issues and enabling automatic discovery, selection and loading of bundles in a distributed system on basis of the peerto-peer platform JXTA. By providing extended bundle descriptions, non-functional properties can be automatically evaluated for bundle selection and dependency resolution. Copyright 2008 ACM.
UnivIS-Import:2015-04-16:Pub.2008.tech.IMMD.IMMD4.decent
Keywords: Automatic code selection; Dependency resolution; Dynamic loading of code; Non-functional properties; OSGi

Dependable non-volatile memory - Martens, Arthur; Scholz, Rouven; Lindow, Phil; Lehnfeld, Niklas; Kastner, Marc A.; Kapitza, Rüdiger (SYSTOR 2018 - Proceedings of the 11th ACM International Systems and Storage Conference, 2018)
Recent advances in persistent memory (PM) enable fast, byteaddressable main memory that maintains its state across power cycling events. To survive power outages and prevent inconsistent application state, current approaches introduce persistent logs and require expensive cache flushes. Thus, these solutions cause a performance penalty of up to 10 for write operations on PM. With respect to wear-out effects, and a significantly lower write performance compared to read operations, we identify this as a major flaw that impacts performance and lifetime of PM. In addition, most PM technologies are susceptible to soft-errors that cause corrupted data, which implies a high risk of a permanently inconsistent system state. In this paper, we present DNV Memory, a library for persistent memory management. For securing allocated data against power outages, multi-bit faults that bypass hardware protection and even usage violations, DNV Memory introduces reliable transactions. Additionally, it reduces writes to PM by offloading logging operations to volatile memory, while maintaining durability on demand by an early detection of upcoming power failures. We compare DNV Memory to pmemobj, a persistent object-store, and show that our system only causes a moderate overhead. In fact, our benchmark results indicate that DNV Memory is even faster than pmemobj for transactions of moderate size.
CRIS-Team Scopus Importer:2022-07-19

Deployment-aware Energy Model for Operator Placement in Sensor Networks - Villanueva, Félix J.; Daum, Michael; Strübe, Moritz; López, J. C.; Kapitza, Rüdiger; Dressler, Falko (Proceedings of 7th IEEE/ACM International Conference on Distributed Computing in Sensor Systems (DCOSS 2011), 2nd International Workshop on Interconnections of Wireless Sensor Networks (IWSN 2011), 2011)
Query processing has become one of the main paradigms to approach information processing in Wireless Sensor Networks (WSNs).We study and identify relevant factors involved in in-network query deployment in WSNs. As a key outcome,we developed a deployment aware cost estimation model for distributing operators to nodes within the network using the network lifetime as a key metric. In contrast to related approaches, we include the state of each node in the cost model. This provides means for an automatic load balancing mechanism that allows us to insert a higher number of queries compared to other approaches, thus, significantly extending the network lifetime.1 © 2011 IEE
UnivIS-Import:2015-04-16:Pub.2011.tech.IMMD.IMMD4.deploy
Keywords: RDSP

Design and Architectures for Dependable Embedded Systems - Henkel, Jörg; Bauer, Lars; Becker, Joachim; Bringmann, Oliver; Brinkschulte, Uwe; Chakraborty, Samarjit; Engel, Michael; Ernst, Rolf; Härtig, Hermann; Hedrich, Lars; Herkersdorf, Andreas; Kapitza, Rüdiger; et al. (Proceedings of the 9th International Conference on Hardware/Software Codesign and System Synthesis (CODES+ISSS '11), 2011)
The paper presents an overview of a major research project on dependable embedded systems that has started in Fall 2010 and is running for a projected duration of six years. Aim is a 'dependability co-design' that spans various levels of abstraction in the design process of embedded systems starting from gate level through operating system, applications software to system architecture. In addition, we present a new classification on faults, errors, and failures. Copyright 2011 ACM.
UnivIS-Import:2015-04-16:Pub.2011.tech.IMMD.IMMD4.design_4
Keywords: embedded systems; dependable systems; danceos

Design und Implementierung eines Frameworks zur Evaluierung Phasenbasierter Agenten - Kapitza, Rüdiger; et al. (2000)
UnivIS-Import:2016-06-30:Pub.2000.tech.IMMD.IMMD4.design

Distributed applications and interoperable systems (Extended papers from DAIS'10) - Kapitza, Rüdiger (Software-Practice & Experience, 2013)
CRIS-Team Scopus Importer:2022-07-19

DQMP: A Decentralized Protocol to Enforce Global Quotas in Cloud Environments - Behl, Johannes; Distler, Tobias; Kapitza, Rüdiger (Proceedings of the 14th International Symposium on Stabilization, Safety, and Security of Distributed Systems (SSS '12), 2012)
Platform-as-a-Service (PaaS) clouds free companies of building infrastructures dimensioned for peak service demand and allow them to only pay for the resources they actually use. Being a PaaS cloud customer, on the one hand, offers a company the opportunity to provide applications in a dynamically scalable way. On the other hand, this scalability may lead to financial loss due to costly use of vast amounts of resources caused by program errors, attacks, or careless use. To limit the effects of involuntary resource usage, we present DQMP, a decentralized, fault-tolerant, and scalable quota-enforcement protocol. It allows customers to buy a fixed amount of resources (e.g., CPU cycles) that can be used flexibly within the cloud. DQMP utilizes the concept of diffusion to equally balance unused resource quotas over all processes running applications of the same customer. This enables the enforcement of upper bounds while being highly adaptive to all kinds of resource-demand changes. Our evaluation shows that our protocol outperforms a lease-based centralized implementation in a setting with 1,000 processes. © 2012 Springer-Verlag.
UnivIS-Import:2015-04-16:Pub.2012.tech.IMMD.IMMD4.dqmpad
Keywords: TCLOUDS

DrySim: Simulation-Aided Deployment-Specific Tailoring of Mote-Class WSN Software - Strübe, Moritz; Lukas, Florian; Li, Bijun; Kapitza, Rüdiger (Proceedings of the 17th ACM international conference on Modeling, analysis and simulation of wireless and mobile systems (MSWiM '14), 2014)
Despite intensive research in the field of mote-class Wireless Sensor Networks in recent years, real-life deployments are still challenging and systems are prone to failures. This can typically be attributed to fragile hardware or misbehaving software. Issues caused by software, often induced by the inherent constraints of resources, can be countered using simulations. However the simulation results often do not reect those of the specific deployment. We suggest analyzing the actual environment conditions of a deployed network and map them to a simulator. Then, based on simulations, software and parameters can be tailored to the specific deployment. We developed two tool chains, RealSim and DryRun, and compared results from simulation runs to those acquired from two different testbeds using Tmote Sky nodes. This was done in two campaigns, each altering 2 configuration parameters from the hardware to the application layer. The presented data is based on over 1100 experiments, respectively over 270 h, on real hardware and almost 7000 simulations. The close relation of simulation and real measurements shows that our DrySim approach is feasible. Copyright 2014 ACM.
UnivIS-Import:2015-04-16:Pub.2014.tech.IMMD.IMMD4.drysim
Keywords: Wireless Sensor Networks; Simulation; Testbed; Deployment

Dynamic Integration of Peer-to-Peer Services into a CORBA compliant Middleware (Poster-Paper) - Kapitza, Rüdiger; et al. (On the Move to Meaningful Internet Systems 2006 - CoopIS, DOA, and ODBASE, 2006)
UnivIS-Import:2015-04-16:Pub.2006.tech.IMMD.IMMD4.dynami

Dynamic Operator Replacement in Sensor Networks - Strübe, Moritz; Daum, Michael; Kapitza, Rüdiger; Villanueva, Felix; Dreßler, Falko (7th IEEE International Conference on Mobile Ad-hoc and Sensor Systems (MASS 2010), Demo Session, 2010)
We present an integrated approach for supporting in-network sensor data processing in dynamic and heterogeneous sensor networks. The concept relies on data stream processing techniques that define and optimize the distribution of queries and their operators. We anticipate a high degree of dynamics in the network, which can for example be expected in the case of wildlife monitoring applications. The distribution of operators to individual nodes demands system level capabilities not available in current sensor node operating systems. In particular, we present a system for seamless and on demand operator migration between sensor nodes. Our framework, which we implemented for Contiki running on TelosB nodes, supports stateful module migration including selected parts of the code and data sections. ©2010 IEEE.
UnivIS-Import:2015-04-16:Pub.2010.tech.IMMD.IMMD4.dynami
Keywords: RDSP

Dynamic Software Management on BTnode Sensors - Strübe, Moritz; Kapitza, Rüdiger; Schröder-Preikschat, Wolfgang; et al. (Proc. of 4th IEEE/ACM Intern. Conf. on Distributed Computing in Sensor Systems, Intern. Workshop on Sensor Network Engineering, 2008)
UnivIS-Import:2015-04-16:Pub.2008.tech.IMMD.IMMD4._dynam_0
Keywords: RDSP

Dynamic Software Update of Resource-Constrained Distributed Embedded Systems - Felser, Meik; Kapitza, Rüdiger; Kleinöder, Jürgen; Schröder-Preikschat, Wolfgang (Embedded System Design: Topics, Techniques and Trends, 2007)
Changing demands, software evolution, and bug fixes require the possibility to update applications as well as system software of embedded devices. Systems that perform updates of resource-constrained nodes are available, but most approaches require a complete restart of the node after installing or updating software. Restarting the node results in the loss of important system state, such as routing information or sensor calibration values. Rebuilding this information requires time and energy. In this paper we present an online state-preserving update system for sourceconstrained nodes. A remote incremental linking approach is used to generate node-specific and execution-state dependent code. Compiler-generated symbol, relocation, and debugging information is used to determine whether a dynamic update of the running system is possible and how it can be achieved. © International Federation for Information Processing 2007.
UnivIS-Import:2015-04-16:Pub.2007.tech.IMMD.IMMD4.dynami
Keywords: Dynamic update; ELF; Managed nodes; Relocations

Dynamic State Partitioning in Parallelized Byzantine Fault Tolerance - Li, Bijun; Xu, Wenbo; Kapitza, Rüdiger (Proceedings - 48th Annual IEEE/IFIP International Conference on Dependable Systems and Networks Workshops, DSN-W 2018, 2018)
Recent research works have shown that applying parallelization to request processing in Byzantine Fault Tolerance (BFT) can bring significant performance improvement. Based on partitioned service state, parallelism is introduced to both agreement and execution to address performance and scalability limitations caused by the global total order of all requests. However, in case of inefficient state partitioning, expensive synchronization among partitions is expected, which leads to a considerable performance loss. To improve the efficiency of parallel processing, we present Dynamic State Partitioning (DYPART), a framework that maps service state into multiple partitions and periodically reconfigures the partitions for different usage patterns. DYPART relies on the knowledge about relations between the state objects for partitioning, which is obtained by collecting request dependencies. It utilizes a high-performance graph partitioning algorithm to ensure that the resulting state partitions can achieve both workload balance and low synchronization among partitions. Our evaluation of a key-value store shows that compared to a random partitioning, DYPART can improve the performance by at least 40%.
CRIS-Team Scopus Importer:2022-07-19
Keywords: Byzantine fault tolerance; graph partition algorithm; parallelization; state partitioning

Dynamic Weaving of Components in a Distributed Environment - Söldner, Guido; Kapitza, Rüdiger; et al. (ACM/IFIP/USENIX 9th International Middleware Conference, 2008)
UnivIS-Import:2015-04-16:Pub.2008.tech.IMMD.IMMD4.dynami

Eactors: Fast and flexible trusted computing using SGX - Sartakov, Vasily A.; Brenner, Stefan; Ben Mokhtar, Sonia; Bouchenak, Sara; Thomas, Gael; Kapitza, Rüdiger (Proceedings of the 19th International Middleware Conference, Middleware 2018, 2018)
Novel trusted execution support, as offered by Intel’s Software Guard eXtensions (SGX), embeds seamlessly into user space applications by establishing regions of encrypted memory, called enclaves. Enclaves comprise code and data that is executed under special protection of the CPU and can only be accessed via an enclave defined interface. To facilitate the usability of this new system abstraction, Intel offers a software development kit (SGX SDK). While the SDK eases the use of SGX, it misses appropriate programming support for inter-enclave interaction, and demands to hardcode the exact use of trusted execution into applications, which restricts flexibility. This paper proposes EActors, an actor framework that is tailored to SGX and offers a more seamless, flexible and efficient use of trusted execution – especially for applications demanding multiple enclaves. EActors disentangles the interaction with enclaves and, among them, from costly execution mode transitions. It features lightweight fine-grained parallelism based on the concept of actors, thereby avoiding costly SGX SDK provided synchronisation constructs. Finally, EActors offers a high degree of freedom to execute actors, either untrusted or trusted, depending on security requirements and performance demands. We implemented two use cases on top of EActors: (i) a secure instant messaging service, and (ii) a secure multi-party computation service. Both illustrate the ability of EActors to seamlessly and effectively build secure applications. Furthermore, our performance evaluation results show that securing the messaging service with EActors improves performance compared to the vanilla versions of JabberD2 and ejabberd by up to 40×.
CRIS-Team Scopus Importer:2022-07-19
Keywords: Actors; Intel SGX; Trusted execution

EDAS: Providing an Environment for Decentralized Adaptive Services - Kapitza, Rüdiger; et al. (IEEE Distributed Systems Online, 2006)
UnivIS-Import:2015-04-14:Pub.2006.tech.IMMD.IMMD4.edaspr

Edgedancer: Secure Mobile WebAssembly Services on the Edge - Nieke, Manuel; Almstedt, Lennart; Kapitza, Rüdiger (EdgeSys 2021 - Proceedings of the 4th International Workshop on Edge Systems, Analytics and Networking, Part of EuroSys 2021, 2021)
Edge computing brings services and data closer to their users. It targets applications where low latency is key, such as cloud-based gaming, augmented reality, and connected cars. In these scenarios mobile users are often the norm, and services need to follow their users to continuously ensure the benefits of edge computing. Mobile edge computing addresses this demand, however, we identified three open challenges: First, edge computing facilities are sparse so far and achieving good connectivity requires a seamless transfer of workloads between different edge providers. Second, migration of edge services needs to be lightweight to make relocation transparent to users. Third, using geo-distributed edge resources of various providers demands for security measures to ensure service integrity and confidentiality.; B@We present E'dgedancer, a platform that offers infrastructure support for portable, provider-independent, and secure migration of edge services. E'dgedancer offers a lightweight and generic execution environment by utilising WebAssembly, which features an efficient, easy to transfer bytecode format. To make edge services self-migratable, and independent from the provider, E'dgedancer supports the notion of mobile agents offering weak and strong migration support. It utilises trusted execution to ensure the security of edge services during execution and migration. Finally, we shows that E'dgedancer features a lower migration time compared to previously proposed virtual machine migration while offering better security and platform independence.
CRIS-Team Scopus Importer:2022-07-19
Keywords: Edge Computing; Trusted Computing; WebAssembly

Effectiveness of Fault Detection Mechanisms in Static and Dynamic Operating System Designs - Hoffmann, Martin; Borchert, Christoph; Dietrich, Christian; Schirmeier, Horst; Kapitza, Rüdiger; Spinczyk, Olaf; Lohmann, Daniel (Proceedings of the 17th IEEE International Symposium on Object/Component/Service-oriented Real-time Distributed Computing (ISORC '14), 2014)
UnivIS-Import:2015-04-16:Pub.2014.tech.IMMD.IMMD4.effect
Keywords: DanceOS; dosek; osek; dependability; static system

Efficient State Transfer for Hypervisor-Based Proactive Recovery - Distler, Tobias; Kapitza, Rüdiger; Reiser, Hans P. (Proceedings of the 2nd Workshop on Recent Advances on Intrusion-Tolerant Systems (WRAITS '08), 2008)

Eliminating Single Points of Failure in Software-Based Redundancy - Ulbrich, Peter; Hoffmann, Martin; Kapitza, Rüdiger; Lohmann, Daniel; Schröder-Preikschat, Wolfgang; Schmid, Reiner (Proceedings of the 9th European Dependable Computing Conference, 2012)
In the domain of safety-critical embedded and cyber-physical systems, software-based redundancy is generally understood as an effective and cheap approach to improve reliability. Especially redundant execution in terms of triple modular redundancy is a well-known solution. However, triple modular redundancy (TMR) leaves unprotected single points of failure (SPOFs), such as the voter, which have to be carefully considered in all safety considerations. We present Combined Redundancy (CoRed), a holistic approach that hardens safety-critical parts of a system against soft-errors, while effectively eliminating the vulnerability caused by SPOFs. CoRed leverages redundant execution in combination with encoded processing to tackle the unprotected voting and data distribution. Its implementation does not require specific knowledge about the application and can be easily integrated into existing projects. We evaluated CoRed in a realistic setting using a quad rotor helicopter and provide experimental evidence for soft-error resistance and comparable low resource demand. In our experimental comparison plain TMR left more than seven percent of failures undetected, whereas CoRed was able to eliminate all silent data corruptions while inducing an overhead of just seven percen
UnivIS-Import:2015-04-16:Pub.2012.tech.IMMD.IMMD4.elimin
Keywords: Domain-specific architectures; Fault-tolerance; Frameworks; Reliability; Soft errors; Software and System Safety; DanceOS

Enabling Mode Changes in a Distributed Automotive System - Mitzlaff, Martin; Kapitza, Rüdiger; Schröder-Preikschat, Wolfgang (Proceedings of the 1st Workshop on Critical Automotive applications: Robustness & Safety, 2010)
Due to the high pressure for innovation, recent cars offer a constantly increasing number of sophisticated functions for advanced driver assistance and an improved active safety. As a result, software complexity in cars rises. Up to now, configurations of current automotive embedded systems are fixed and remain static over the vehicle lifetime. However, this is problematic as all offered functions have to be taken into account for the schedule of currently upcoming time-triggered bus systems and also the OS schedules on the electronic control units (ECUs). In principle, this is not necessary, as subsets of these functions have disjoint phases of use. This paper presents dynamic reconfiguration in cars based on mode changes, allowing to switch between a set of statically defined bus and ECUs schedules during runtime. This decreases the resource usage and the complexity of a specific set of bus and ECU schedules, as only active functions have to be considered. We outline how such a mode change can safely be enabled using a membership service for a time-triggered bus system and outline our experience in the context of a practical use case scenario: dedicated modes for normal operation and for servicing a car. © 2010 ACM.
UnivIS-Import:2015-04-16:Pub.2010.tech.IMMD.IMMD4.enabli
Keywords: FlexRay; membership; mode change; software-update; automotive; scheduling

EndBox: Scalable middlebox functions using Client-Side trusted execution - Goltzsche, David; Ruesch, Signe; Nieke, Manuel; Vaucher, Sebastien; Weichbrodt, Nico; Schiavoni, Valerio; Aublin, Pierre-Louis; Costa, Paolo; Fetzer, Christof; Felber, Pascal; Pietzuch, Peter; Kapitza, Rüdiger (Proceedings - 48th Annual IEEE/IFIP International Conference on Dependable Systems and Networks, DSN 2018, 2018)
Many organisations enhance the performance, security, and functionality of their managed networks by deploying middleboxes centrally as part of their core network. While this simplifies maintenance, it also increases cost because middlebox hardware must scale with the number of clients. A promising alternative is to outsource middlebox functions to the clients themselves, thus leveraging their CPU resources. Such an approach, however, raises security challenges for critical middlebox functions such as firewalls and intrusion detection systems. We describe EndBox, a system that securely executes middlebox functions on client machines at the network edge. Its design combines a virtual private network (VPN) with middlebox functions that are hardware-protected by a trusted execution environment (TEE), as offered by Intel's Software Guard Extensions (SGX). By maintaining VPN connection endpoints inside SGX enclaves, EndBox ensures that all client traffic, including encrypted communication, is processed by the middlebox. Despite its decentralised model, EndBox's middlebox functions remain maintainable: They are centrally controlled and can be updated efficiently. We demonstrate EndBox with two scenarios involving (i) a large company; and (ii) an Internet service provider that both need to protect their network and connected clients. We evaluate EndBox by comparing it to centralised deployments of common middlebox functions, such as load balancing, intrusion detection, firewalling, and DDoS prevention. We show that EndBox achieves up to 3.8x higher throughput and scales linearly with the number of clients.
CRIS-Team Scopus Importer:2022-07-19
Keywords: Middlebox; Offloading; Trusted Execution

EndBox: Scalable Middlebox Functions Using Client-Side Trusted Execution - Goltzsche, David; Schwarz-Rüsch, Signe; Nieke, Manuel; Vaucher, Sebastien; Weichbrodt, Nico; Schiavoni, Valerio; Aublin, Pierre-Louis; Costa, Paolo; Fetzer, Christof; Felber, Pascal; Pietzuch, Peter; Kapitza, Rüdiger (Proceedings of the 48th International Conference on Dependable Systems and Networks, 2018)
Many organisations enhance the performance, security, and functionality of their managed networks by deploying middleboxes centrally as part of their core network. While this simplifies maintenance, it also increases cost because middlebox hardware must scale with the number of clients. A promising alternative is to outsource middlebox functions to the clients themselves, thus leveraging their CPU resources. Such an approach, however, raises security challenges for critical middlebox functions such as firewalls and intrusion detection systems. We describe EndBox, a system that securely executes middlebox functions on client machines at the network edge. Its design combines a virtual private network (VPN) with middlebox functions that are hardware-protected by a trusted execution environment (TEE), as offered by Intel’s Software Guard Extensions (SGX). By maintaining VPN connection endpoints inside SGX enclaves, EndBox ensures that all client traffic, including encrypted communication, is processed by the middlebox. Despite its decentralised model, EndBox's middlebox functions remain maintainable: they are centrally controlled and can be updated efficiently. We demonstrate EndBox with two scenarios involving (i) a large company; and (ii) an Internet service provider that both need to protect their network and connected clients. We evaluate EndBox by comparing it to centralised deployments of common middlebox functions, such as load balancing, intrusion detection, firewalling, and DDoS prevention. We show that EndBox achieves up to 3.8x higher throughput and scales linearly with the number of clients.<br

Energy-Aware Programming Utilizing the SEEP Framework and Symbolic Execution - Hönig, Timo; Eibel, Christopher; Kapitza, Rüdiger; Schröder-Preikschat, Wolfgang (Proceedings of the 23rd ACM Symposium on Operating Systems Principles (SOSP 2011), Poster Session, 2011)
UnivIS-Import:2015-04-16:Pub.2011.tech.IMMD.IMMD4.energy

Enhancing Coordination in Cloud Infrastructures with an Extendable Coordination Service - Distler, Tobias; Fischer, Frank; Kapitza, Rüdiger; Ling, Siqi (Proceedings of the 1st Workshop on Secure and Dependable Middleware for Cloud Monitoring and Management (SDMCMM '12), 2012)
With application processes being distributed across a large number of nodes, coordination is a crucial but inherently difficult task in cloud environments. Coordination middleware systems like Chubby and ZooKeeper approach this problem by providing mechanisms for basic coordination tasks (e. g., leader election) and means to implement common data structures used for coordination (e. g., distributed queues). However, as such complex abstractions still need to be implemented as part of the distributed application, reusability is limited and the performance overhead may be significant. In this paper, we address these problems by proposing an extendable coordination service that allows complex abstractions to be implemented on the server side. To enhance the functionality of our coordination service, programmers are able to dynamically register high-level extensions that comprise a sequence of low-level operations offered by the standard coordination service API. Our evaluation results show that extension-based implementations of common data structures and services offer significantly better performance and scalability than their state-of-the-art counterparts. © 2012 AC
UnivIS-Import:2015-04-16:Pub.2012.tech.IMMD.IMMD4.enhanc
Keywords: TCLOUDS

EsseOS: Haskell-based Tailored Services for the Cloud - Stengel, Klaus; Schmaus, Florian; Kapitza, Rüdiger (Proceedings of the 12th International Workshop on Adaptive and Reflective Middleware (ARM '13), 2013)
Cloud computing offers a pay-per-use model and elasticity for hosted applications. The latter demands for decomposing an application into services, where each of them is executed by dedicated virtual machines. Typically, off-the-self operating systems (e.g., Linux) and managed runtime support (e.g., Java) are utilized thereby causing an unnecessary huge code base, resulting in a rather large attack surface. To address these problems, we present EsseOS, a platform for tailoring services as well as their associated runtime environment. EsseOS aims at reducing the attack surface by adapting the entire software stack that runs in a virtual machine to capture only the functionally essentially needed. This is achieved by following a clean-slate approach leveraging the advantages of Haskell, a functional programming language. We structure our software to be reconfigurable to remove unnecessary parts while still ensuring correct interaction between features by relying on Haskell's advanced type system. Initial results indicate an order of magnitude smaller code base for a tailored version of both Memcached and its execution environment compared to the original C-based version running on top of Linux. © 2013 ACM.
UnivIS-Import:2017-12-18:Pub.2013.tech.IMMD.IMMD4.esseos
Keywords: Haskell; cloud computing; functional programming; operating systems; security; software tailoring

EventChain: A Blockchain Framework for Secure, Privacy-Preserving Event Verification - Schwarz-Rüsch, Signe; Behlendorf, Michael; Becker, Markus Horst; Kudlek, René; Mohamed, Hesham Hosney Elsayed; Schoenitz, Felix; Jehl, Leander; Kapitza, Rüdiger (23rd ACM/IFIP International Middleware Conference, 2022)
The number of fake news written by bots or malicious actors on social media is rising. One cause is the ability of users to post anything, at any place, at any time. This offers great flexibility, but it also poses the risk that users share misinformation. One type includes events that allegedly have occurred in a location, without the reporting user necessarily having been present. A user may add her location to posts to appear as an eyewitness and thus more trustworthy; however, basing that trust on commonly used and easily faked GPS locations is not reasonable. We present EventChain, which enriches social media posts with hard to fake trust scores based on the user's recent motion profile to give actual eyewitnesses more credibility. Users' motion profiles are integrity- and privacy-preservingly logged in a blockchain. Once the user posts an event, her locality is evaluated for a location rating. The location evaluation is secured by a trusted execution environment to ensure users' location data is private and under the users' control at all times. EventChain also enables interactive assessments of a post via nearby users, whose location is similarly evaluated. This way other eyewitnesses can credibly provide further information, thus leading to a consensus about the event's actual occurrences, increasing trust in social media posts, and limiting the spread of fake new
Keywords: Blockchain; TEE; Location Privacy; Fake News

Extending Mobile Devices by Exploiting Remote Resources - Hönig, Timo; Kapitza, Rüdiger; Schröder-Preikschat, Wolfgang (Proceedings of ACM European Conference on Computer Systems (EuroSys 2010), Poster Session, 2010)
UnivIS-Import:2015-04-16:Pub.2010.tech.IMMD.IMMD4.extend_7

FAIL*: Towards a Versatile Fault-Injection Experiment Framework - Schirmeier, Horst; Hoffmann, Martin; Kapitza, Rüdiger; Lohmann, Daniel; Spinczyk, Olaf (Workshop on Dependability and Fault-Tolerance (VERFE), 2012)
Many years of research on dependable, fault-tolerant software systems yielded many tool implementations for vulnerability analysis and experimental validation of resilience measures. We identify two disjoint classes of fault-injection (FI) experiment tools in the field, and argue that both are plagued by inherent deficiencies, such as insufficient target state access, little or no means to switch to another target system, and non-reusable experiment code. In this article, we present a novel design approach for a FI infrastructure that aims at combining the strengths of both classes. Our Fail * experiment framework provides carefully-chosen abstractions simplifying both the implementation of different simulator/hardware target backends and the reuse of experiment code, while retaining the ability for deep targetstate access for specialized FI experiments. An exemplary report on first experiences with a prototype implementation based on existing x86 and ARM simulators demonstrates the tool's versatility. © 2012 Gesellschaft fuer Informatk.
UnivIS-Import:2015-04-16:Pub.2012.tech.IMMD.IMMD4.failto

Fault-Tolerant Replication Based on Fragmented Objects - Kapitza, Rüdiger; et al. (Distributed Applications and Interoperable Systems (DAIS), 2006)
This paper describes a novel approach to fault-tolerance in distributed object-based systems. It uses the fragmented-object model to integrate replication mechanisms into distributed applications. This approach enables the use of customised code on a per-object basis to access replica groups and to manage consistency. The addition of fault tolerance to the infrastructure has only little overhead, is fully transparent for clients, and does not require internal modifications to the existing middleware. Semantic annotations at the interface level allow the developer to customise the provision of fault tolerance. Operations can be marked as read-only to allow an execution with weaker ordering semantics or as parallelisable to allow true multithreaded execution. A code-generation tool is provided to automatically produce object-specific fragment code for client access and for replica consistency management, taking into account the annotations, the interface specification, and the non-replicated implementation. A further contribution of our code-generation approach is the support of deterministic multithreading in replicated objects. © IFIP International Federation for Information Processing 2006.
UnivIS-Import:2015-04-16:Pub.2006.tech.IMMD.IMMD4.faultt

FOREVER: Fault/intrusiOn REmoVal through Evolution & Recovery - Distler, Tobias; Kapitza, Rüdiger; et al. (Companion '08: Proceedings of the ACM/IFIP/USENIX Middleware '08 Conference Companion, 2008)
UnivIS-Import:2015-04-16:Pub.2008.tech.IMMD.IMMD4.foreve

FORMI: Integrating Adaptive Fragmented Objects into Java RMI - Kapitza, Rüdiger; et al. (IEEE Distributed Systems Online, 2006)
FORMI integrates fragmented objects into Java RMI without requiring internal modifications to the RMI runtime and can dynamically adapt themselves by replacing existing fragments. Each FORMI object fragment internally consists of multiple components and changes the RMI architecture's stub-skeleton and reference layers. The FORMI infrastructure supports dynamic reconfiguration and adaptation of fragmented objects by providing a mechanism for replacing the fragment implementation at runtime. It's simple dictionary service demonstrates its self-adaptation features, which provides a remotely accessible dictionary with a get and a set method at some nodes. This approach is convenient for small user groups, which can provide an extended client-side fragment for stream sharing within a local network. Further development to extend the developer support and enhancing the FORMI compiler to generate glue code for fault tolerance are being planned.
UnivIS-Import:2015-04-14:Pub.2006.tech.IMMD.IMMD4.formii

Forward secure delay-tolerant networking - Schwarz-Rüsch, Signe; Schürmann, Dominik; Wolf, Lars; Kapitza, Rüdiger (CHANTS 2017 - Proceedings of the 12th Workshop on Challenged Networks, co-located with MobiCom 2017, 2017)
Delay-Tolerant Networks exhibit highly asynchronous connections often routed over many mobile hops before reaching its intended destination. The Bundle Security Protocol has been standardized providing properties such as authenticity, integrity, and confidentiality of bundles using traditional Public-Key Cryptography. Other protocols based on Identity-Based Cryptography have been proposed to reduce the key distribution overhead. However, in both schemes, secret keys are usually valid for several months. Thus, a secret key extracted from a compromised node allows for decryption of past communications since its creation. We solve this problem and propose the first forward secure protocol for Delay-Tolerant Networking. For this, we apply the Puncturable Encryption construction designed by Green and Miers, integrate it into the Bundle Security Protocol and adapt its parameters for different highly asynchronous scenarios. Finally, we provide performance measurements and discuss their impact.
CRIS-Team Scopus Importer:2022-07-19
Keywords: Delay-Tolerant Networking; Dtn; Forward secrecy; Puncturable Encryption

Functional Decomposition and Interactions in Hybrid Intrusion-tolerant Systems - Reiser, Hans P.; Distler, Tobias; Kapitza, Rüdiger (Proceedings of the 3rd Workshop on Middleware-Application Interaction (MAI '09), 2009)

Glamdring: Automatic application partitioning for intel SGX - Lind, Joshua; Priebe, Christian; Muthukumaran, Divya; O'Keeffe, Dan; Aublin, Pierre Louis; Kelbert, Florian; Reiher, Tobias; Goltzsche, David; Eyers, David; Fetzer, Christof; Pietzuch, Peter; Kapitza, Rüdiger (Proceedings of the 2017 USENIX Annual Technical Conference, USENIX ATC 2017, 2019)
Trusted execution support in modern CPUs, as offered by Intel SGX enclaves, can protect applications in untrusted environments. While prior work has shown that legacy applications can run in their entirety inside enclaves, this results in a large trusted computing base (TCB). Instead, we explore an approach in which we partition an application and use an enclave to protect only security-sensitive data and functions, thus obtaining a smaller TCB. We describe Glamdring, the first source-level partitioning framework that secures applications written in C using Intel SGX. A developer first annotates security-sensitive application data. Glamdring then automatically partitions the application into untrusted and enclave parts: (i) to preserve data confidentiality, Glamdring uses dataflow analysis to identify functions that may be exposed to sensitive data; (ii) for data integrity, it uses backward slicing to identify functions that may affect sensitive data. Glamdring then places security-sensitive functions inside the enclave, and adds runtime checks and cryptographic operations at the enclave boundary to protect it from attack. Our evaluation of Glamdring with the Memcached store, the LibreSSL library, and the Digital Bitbox bitcoin wallet shows that it achieves small TCB sizes and has acceptable performance overheads.
CRIS-Team Scopus Importer:2022-07-19

Honey, I Shrunk the Guests Page Access Tracking using a Minimal Virtualisation Layer - Nguyen, Dustin Tien; Rußer, Sebastian; Ott, Maximilian; Kapitza, Rüdiger; Schröder-Preikschat, Wolfgang; Nolte, Jörg (4th Workshop on Heterogeneous Composable and Disaggregated Systems, 2025)
Advances in memory-intensive areas such as machine learning and graph processing drive demand for suited memory technologies. Part of the answer lies in multi-memory architectures with fast and high-capacity memory tiers. Heterogeneous systems can be very diverse, ranging from NUMA to persistent memory and CXL-attached memory. Efficient usage requires support from the operating system (OS) with knowledge of memory performance characteristics and detailed insight into the page access behaviour of processes. Gathering statistics on the read/write-ratio of accesses and (huge) page utilisation is expensive with common methods. In this paper, we propose vmmload, a minimal virtualisation layer to monitor user space programs using a virtualisation-based page modification log (PML) for efficiently gathering runtime statistics. While PML is a hardware extension that was originally designed to track virtual machine memory access, vmmload enables observation of individual processes. vmmload monitored user space processes run with PML-enabled virtualisation, but are still able to interface with the host OS. We explore the viability of using PML without a conventional virtual machine and providing the host OS with the ability to use these extensions directl

Hybrid fault-tolerant consensus in asynchronous and wireless embedded systems - Xu, Wenbo; Schwarz-Rüsch, Signe; Li, Bijun; Kapitza, Rüdiger (Leibniz International Proceedings in Informatics, LIPIcs, 2019)
Byzantine fault-tolerant (BFT) consensus in an asynchronous system can only tolerate up to [n-1/3] faulty processes in a group of n processes. This is quite a strict limit in certain application scenarios, for example a group consisting of only 3 processes. In order to break through this limit, we can leverage a hybrid fault model, in which a subset of the system is enhanced and cannot be arbitrarily faulty except for crashing. Based on this model, we propose a randomized binary consensus algorithm that executes in complete asynchrony, rather than in partial synchrony required by deterministic algorithms. It can tolerate up to [n-1/3] Byzantine faulty processes as long as the trusted subsystem in each process is not compromised, and terminates with a probability of one. The algorithm is resilient against a strong adversary, i. e. the adversary is able to inspect the state of the whole system, manipulate the delay of every message and process, and then adjust its faulty behaviour during execution. From a practical point of view, the algorithm is lightweight and has little dependency on lower level protocols or communication primitives. We evaluate the algorithm and the results show that it performs promisingly in a testbed consisting of up to 10 embedded devices connected via an ad hoc wireless network.
CRIS-Team Scopus Importer:2022-07-19
Keywords: Consensus; Distributed system; Fault tolerance

Hybrids on Steroids: SGX-based High Performance BFT - Behl, Johannes; Distler, Tobias; Kapitza, Rüdiger (Proceedings of the 12th European Conference on Computer Systems (EuroSys '17), 2017)
UnivIS-Import:2017-03-24:Pub.2017.tech.IMMD.IMMD4.hybrid
Keywords: REFIT

Hybster - A Highly Parallelizable Protocol for Hybrid Fault-Tolerant Service Replication - Behl, Johannes; Distler, Tobias; Kapitza, Rüdiger (2017)

I4Copter: An Adaptable and Modular Quadrotor Platform - Ulbrich, Peter; Kapitza, Rüdiger; Harkort, Christian; Schmid, Reiner; Schröder-Preikschat, Wolfgang (Proceedings of the 26th ACM Symposium on Applied Computing, 2011)
Quadrotor helicopters are micro air vehicles with vertical take-off and landing capabilities controlled by varying the rotation speed of four fixed pitch propellers. Due to their rather simple mechanical design they have grown to popularity as platform for various research projects. Despite most of them being individually highly successful, they are typically tailored to a specific purpose making it hard to utilise them for further research and education. In this paper, we present the novel design of the I4Copter quadrotor. It has been developed to provide a stable demonstration quadrotor platform for various kinds of research and education projects targeting cross-field challenges in real-time and embedded systems, distributed systems, robotics and cybernetics. The modular and open architecture of our platform allows an application- specific, fine-grained extension, adaption and replacement of software and hardware components. The safe extensibility is supported by strict temporal and spatial isolation between the software modules. We validated our approach by two distinct cross-field use cases: an evaluation platform for modularised control algorithms enabling trajectory tracking and an implementation that is resilient to transient hardware errors. © 2011 ACM.
UnivIS-Import:2015-04-16:Pub.2011.tech.IMMD.IMMD4.i4copt
Keywords: I4Copter; Safety-critical mission scenario; Real-time application development; Static analysis; Research demonstrator; Quadrocopter; Quadrotor; Quadcopter

Increasing Performance in Byzantine Fault-Tolerant Systems with On-Demand Replica Consistency - Distler, Tobias; Kapitza, Rüdiger (Proceedings of the EuroSys 2011 Conference (EuroSys '11), 2011)
Traditional agreement-based Byzantine fault-tolerant (BFT) systems process all requests on all replicas to ensure consistency. In addition to the overhead for BFT protocol and state-machine replication, this practice degrades performance and prevents throughput scalability. In this paper, we propose an extension to existing BFT architectures that increases performance for the default number of replicas by optimizing the resource utilization of their execution stages. Our approach executes a request on only a selected subset of replicas, using a selector component co-located with each replica. As this leads to divergent replica states, a selector on-demand updates outdated objects on the local replica prior to processing a request. Our evaluation shows that with each replica executing only a part of all requests, the overall performance of a Byzantine fault-tolerant NFS can be almost doubled; our prototype even outperforms unreplicated NFS. Copyright © 2011 ACM.
UnivIS-Import:2015-04-16:Pub.2011.tech.IMMD.IMMD4.increa
Keywords: REFIT

MATEE: Multimodal Attestation for Trusted Execution Environments - Galanou, Anna; Gregor, Franz; Kapitza, Rüdiger; Fetzer, Christof (Proceedings of the 23rd Conference on 23rd ACM/IFIP International Middleware Conference, 2022)
Confidential computing services enable users to run their workloads in Trusted Execution Environments (TEEs) leveraging secure hardware like Intel SGX, and verify them by performing remote attestation. This process offers necessary proof for the integrity of users' software and the authenticity of the hardware, signed by a hardware-specific attestation key. Recent side-channel attacks have successfully retrieved such keys, enabling attackers to forge the attestation data and thereby undermining users' trust in their TEE. If the attestation proof is bound to a second hardware root of trust impervious to side-channel attacks, then the remote attestation process can maintain its security guarantees.In this paper, we introduce MATEE, a novel remote attestation mechanism for TEEs that creates a second chain of trust to a Trusted Platform Module (TPM), adding diverse redundancy into the existing attestation process. Targeting SGX enclaves for our prototype, as the most prominent TEE implementation to date, we describe how MATEE satisfies the necessary security requirements as well as present several scenarios that demonstrate its applicability and its benefits to the confidential computing landscape.
Keywords: SGX; side-channel attacks; attestation; TPM; TEEs

Monitoring Bats in the Wild: On Using Erasure Codes for Energy-Efficient Wireless Sensor Networks - Dressler, Falko; Mutschlechner, Margit; Li, Bijun; Kapitza, Rüdiger; Ripperger, Simon; Eibel, Christopher; Herzog, Benedict; Hönig, Timo; Schröder-Preikschat, Wolfgang (ACM Transactions on Sensor Networks, 2016)
UnivIS-Import:2016-06-01:Pub.2016.tech.IMMD.IMMD4.monito
Keywords: Algorithms; C.2.2 [Computer-Communication Networks]: network Protocols; Design; Energy efficiency; Erasure codes; Forward error correction; Performance; Reliable communication; Wireless sensor networks

Multi-site synchronous VM replication for persistent systems with asymmetric read/write latencies - Sartakov, Vasily A.; Kapitza, Rüdiger (Proceedings of IEEE Pacific Rim International Symposium on Dependable Computing, PRDC, 2017)
Novel non-volatile memory is considered as a future replacement for conventional main memory. While besides persistence non-volatile memory technologies promise higher storage density and lower power demand, they also possess an asymmetry between fast read and slow write access times. The latter can be in the order of 2x to even 20x. While persistent main memory per se asks for novel system software support, the asymmetry between read and write access times needs to be addressed for building efficient solutions. This paper addresses virtual machine replication for high availability when non-volatile memory is put in use. So far asynchronous VM replication that stops a virtual machine, performs a local copy of dirty pages, resumes the virtual machine, before the data is transferred to a back-up site, is the state of the art. In contrast, we propose a multi-site zero-copy synchronous VM replication, which utilizes Remote Direct Memory Access and is tolerant to different read/write latencies. We demonstrate that for future hardware settings synchronous VM replication provides a performance increase of up to 27% compared to current best practices.
CRIS-Team Scopus Importer:2022-07-19
Keywords: NV-RAM; Persistent Systems; RDMA; Replication; Virtualization

Multithreading Strategies for Replicated Objects - Kapitza, Rüdiger; et al. (Middleware 2008, 2008)
Replicating objects usually requires deterministic behaviour for maintaining a consistent state. Multithreading is a critical source of non-determinism, completely unsupported in most fault-tolerant middleware systems. Recent publications have defined deterministic scheduling algorithms that operate at the middleware level and allow multithreading for replicated objects. This approach avoids deadlocks, improves performance, and makes the development better resemble that of non-replicated objects. This paper surveys those algorithms and analyses their differences. It also defines extensions to two efficient multithreading algorithms to support nested invocations and condition variables with time-bounded wait operations similar to the Java synchronisation model. In addition, we provide an experimental evaluation and performance comparison of the algorithms, indicating the areas in which each algorithm performs best. We conclude that replication middleware should implement reconfigurable multithreading strategies, as there is no optimal one-size-fits-all solution. © 2008 Springer Berlin Heidelberg.
UnivIS-Import:2015-04-16:Pub.2008.tech.IMMD.IMMD4.multit

NV-Hypervisor: Hypervisor-based persistence for virtual machines - Sartakov, Vasily A.; Kapitza, Rüdiger (Proceedings of the International Conference on Dependable Systems and Networks, 2014)
Power outages and subsequent recovery are major causes of service downtimes. This issue is amplified by the ongoing trend of steadily growing in-memory state of Internet-based services which increases the risk of data loss and extends recovery time. Protective measures against power outages, such as uninterruptible power supply are expensive, maintenance-intensive and often fragile. With the advent of non-volatile random-access memory (NVRAM) provided by commodity servers, there is a scalable, less costly and robust alternative to recover from power outages and other failures. However, as of today, off-the-shelf software is not ready for benefiting from NVRAM. We present NV-Hyper visor a lightweight hyper visor extension that transparently provides persistence for virtual machines. NV-Hyper visor paves the way for utilizing NVRAM in virtualized environments (i.e., infrastructure-as-a-service clouds) and protects stateful services such as key-value stores and databases from data loss and time-consuming recovery.
CRIS-Team Scopus Importer:2022-07-19
Keywords: Cloud Computing; Hypervisor; NV-RAM; Operating Systems

OSGi4C : Enabling OSGi for the Cloud - Kapitza, Rüdiger; et al. (Proceedings of the Fourth International Conference on COMmunication System softWAre and MiddlewaRE (COMSWARE 2009), 2009)
OSGi is an industry standard for a lean Java-based component system with focus on local applications following the service-oriented architecture. Initially developed for dedicated application domains such as gateways and set-top boxes it is meanwhile used in many other areas, with Eclipse as a prominent example. OSGi allows dynamic deployment of components called bundles with automatic local dependency resolution on basis of exported Java packages. In this regard, OSGi builds an ideal basis for demand-driven deployment of complex Java applications, such as needed in the context of emerging cloud computing infrastructures. However, it lacks distributed code deployment and resolving. We present OSGi for the Cloud (OSGi4C), a novel OSGi service allowing seamless deployment of locally non-existent OSGi bundles and services on demand without requiring any changes to the OSGi platform. In OSGi4C, we use an underlying peer-to-peer infrastructure to provide, share and load OSGi bundles at runtime. Unlike related work, OSGi4C automatically resolves OSGi bundle and service dependencies. Therefore, dependent bundles that are not yet locally installed are also deployed. OSGi4C considers platform-specific implementations (e.g., native code) and non-functional requirements (e.g., performance and resource demand) while automatically discovering and selecting the best of multiple available bundles for download. Copyright 2009 ACM.
UnivIS-Import:2015-04-16:Pub.2009.tech.IMMD.IMMD4.osgi4c
Keywords: Cloud computing; Dependency resolution; Dynamic loading of code; Non-functional properties; OSGi

Precursor: A fast, client-centric and trusted key-value store using RDMA and Intel SGX - Messadi, Ines; Neumann, Shivananda; Weichbrodt, Nico; Almstedt, Lennart; Mahhouk, Mohammad; Kapitza, Rüdiger (Middleware 2021 - Proceedings of the 22nd International Middleware Conference, 2021)
As offered by the Intel Software Guard Extensions (SGX), trusted execution enables confidentiality and integrity for off-site deployed services. Thereby, securing key-value stores has received particular attention, as they are a building block for many complex applications to speed-up request processing. Initially, the developers' main design challenge has been to address the performance barriers of SGX. Besides, we identified the integration of a SGX-secured key-value store with recent network technologies, especially RDMA, as an essential emerging requirement. RDMA allows fast direct access to remote memory at high bandwidth. As SGX-protected memory cannot be directly accessed over the network, a fast exchange between the main and trusted memory must be enabled. More importantly, SGX-protected services can be expected to be CPU-bound as a result of the vast number of cryptographic operations required to transfer and store data securely. In this paper, we present Precursor, a new key-value store design that utilizes trusted execution to offer confidentiality and integrity while relying on RDMA for low latency and high bandwidth communication. Precursor offloads cryptographic operations to the client-side to prevent a server-side CPU bottleneck and reduces data movement in and out of the trusted execution environment. Our evaluation shows that Precursor achieves up to 6 - 8.5 times higher throughput when compared against similar SGX-secured key-value store approaches.
CRIS-Team Scopus Importer:2022-07-19
Keywords: Intel SGX; key-value stores; RDMA

Preface - da Silva, Dilma; Distler, Tobias; Kapitza, Rüdiger (Middleware 2020 - Proceedings of the 2020 21st International Middleware Conference, 2020)
CRIS-Team Scopus Importer:2021-04-19

Proactive Energy-Aware Programming with PEEK - Hönig, Timo; Janker, Heiko; Mihelic, Oliver; Eibel, Christopher; Kapitza, Rüdiger; Schröder-Preikschat, Wolfgang (Proceedings of the 2014 Conference on Timely Results in Operating Systems (TRIOS '14), 2014)
UnivIS-Import:2015-04-16:Pub.2014.tech.IMMD.IMMD4.proact

Proactive Energy-Aware System Software Design with SEEP - Hönig, Timo; Eibel, Christopher; Schröder-Preikschat, Wolfgang; Kapitza, Rüdiger; et al. (Proceedings of the 2nd Workshop on Energy Aware Software-Engineering and Development, 2013)
UnivIS-Import:2015-04-16:Pub.2013.tech.IMMD.IMMD4.proact

ProSEEP: A Proactive Approach to Energy-Aware Programming - Hönig, Timo; Kapitza, Rüdiger; Schröder-Preikschat, Wolfgang (Proceedings of the 2012 USENIX Annual Technical Conference (ATC 2012), Poster Session, 2012)
UnivIS-Import:2015-04-16:Pub.2012.tech.IMMD.IMMD4.prosee

Protecting secrets of persistent systems with volatility - Sartakov, Vasily A.; Kapitza, Rüdiger; Kapitza, Rüdiger (Proceedings - 2019 15th European Dependable Computing Conference, EDCC 2019, 2019)
The volatility of main memory and CPU caches is an important implicit protection mechanism for sensitive data: in-memory data gets erased if memory modules are disconnected from power supply. Persistent systems, on the other hand, cannot rely on volatility and without further measures their secrets can be easily retrieved by physical access. In this paper, we present Volatility, a system which protects secrets stored in persistent memory. This system provides mechanisms which turn persistent sub-systems into volatile ones by the use of AMD Secure Memory Encryption (SME), a new extension of AMD CPUs which provides encryption of main memory at the page granularity. Volatility protects secrets at two levels: it offers fine-grained memory encryption inside the kernel, where only information considered as sensitive is secured, and per-process memory encryption, which encrypts selected user space programs. Besides storing subsystems in an encrypted form, all relevant input and output paths, e.g. managed by the kernel, are protected as well. Our evaluation of Volatility demonstrates that the proposed protection mechanism does not impact the system performance, while protecting against strong adversaries.
CRIS-Team Scopus Importer:2022-07-19
Keywords: AMD SME; Memory encryption; NV RAM; Persistent systems; Volatile-by-encryption

Providing Context-Aware Adaptations Based on a Semantic Model - Söldner, Guido; Kapitza, Rüdiger; Meier, René (Proceedings of the 11th IFIP International Conference on Distributed Applications and Interoperable Systems, 2011)
Smartphones and tablet PCs are on the verge of revolutionizing the information society by offering high quality applications and almost permanent connectivity to the Internet in a mobile world. They naturally support new applications that take advantage of context information like location, time and other environmental conditions. However, developing these novel context-aware applications is challenging as it is difficult to a priori anticipate their execution context and the adaptations that might be necessary to use new context information. This issue is reinforced by the semantic gap between the low-level technical realization of adaptation mechanisms and the demand to describe adaptations in abstract and comprehensible business terms. This paper presents programming support for context-aware adaptations based on a semantic model that builds on the AOCI framework. Using such a model, applications and adaptations can be described by means of easy to comprehend business terms. Thereby the model enables the AOCI framework to store and publish both context and domain-specific run-time information and provides a basis for high-level and tailored programming support. This enables to transparently select adaptations based on various criteria and integrate them into applications at run-time. At the level of adaptation mechanisms our approach supports integration for permanent changes using Aspect-Oriented Programming and more importantly for spontaneous and short-time integration of web services by means of interceptors. © 2011 IFIP International Federation for Information Processing.
UnivIS-Import:2015-04-16:Pub.2011.tech.IMMD.IMMD4.provid
Keywords: AOCI

Providing Decentralised Adaptive Services - Kapitza, Rüdiger (Friedrich-Alexander-Universität Erlangen-Nürnberg, 2007)
UnivIS-Import:2016-07-26:Pub.2007.tech.IMMD.IMMD4.provid

Providing Fault-tolerant Execution of Web-service-based Workflows within Clouds - Behl, Johannes; Distler, Tobias; Heisig, Florian; Kapitza, Rüdiger; Schunter, Matthias (Proceedings of the 2nd International Workshop on Cloud Computing Platforms (CloudCP '12), 2012)
With a variety of services rapidly evolving at all architectural levels of cloud computing, there is an increasing demand for a standardized way to coordinate their interactions. Business process management, that is, more general, the management of Web-service-based workflows, could satisfy this demand and, indeed, first corresponding offerings have gained instant popularity. While from a functional perspective, these Platform-as-a-Service (PaaS) solutions are already quite mature, their support for fault tolerance is still very limited, making them inapplicable for critical tasks. Concerning the deficiencies of currently existing systems, this paper presents a practical solution for executing critical Web-service-based workflows, particularly within clouds, in a fault-tolerant, highly available and highly configurable manner. We achieve this by actively replicating workflows as well as Web services in a combined architecture, reusing existing standard systems and coordination services. By providing an automated transformation tool, replication is realized transparently to existing systems and workflows. Measurements show that our proposed architecture achieves lower response times than existing systems and that the integration of a coordination service imposes only moderate costs, while simplifying the implementation and leading to a dynamically adaptable solution. © 2012 ACM.
UnivIS-Import:2015-04-16:Pub.2012.tech.IMMD.IMMD4.provid
Keywords: TCLOUDS

Proximity sensors on common noctule bats reveal evidence that mothers guide juveniles to roosts but not food - Ripperger, Simon; Günther, Linus; Wieser, Hanna; Duda, Niklas; Hierold, Martin; Cassens, Björn; Kapitza, Rüdiger; Kölpin, Alexander; Mayer, Frieder (Biology Letters, 2019)

Quantifiable run-time kernel attack surface reduction - Kurmus, Anil; Dechand, Sergej; Kapitza, Rüdiger (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), 2014)
The sheer size of commodity operating system kernels makes them a prime target for local attackers aiming to escalate privileges. At the same time, as much as 90% of kernel functions are not required for processing system calls originating from a typical network daemon. This results in an unnecessarily high exposure. In this paper, we introduce kRazor, an approach to reduce the kernel's attack surface by limiting the amount of kernel code accessible to an application. kRazor first traces individual kernel functions used by an application. kRazor can then detect and prevent uses of unnecessary kernel functions by a process. This step is implemented as a kernel module that instruments select kernel functions. A heuristic on the kernel function selection allows kRazor to have negligible performance overhead. We evaluate results under real-world workloads for four typical server applications. Results show that the performance overhead and false positives remain low, while the attack surface reduction can be as high as 80%. © 2014 Springer International Publishing.
CRIS-Team Scopus Importer:2022-07-19

Query Processing and System-Level Support for Runtime-Adaptive Sensor Networks - Dressler, Falko; Kapitza, Rüdiger; Daum, Michael; Strübe, Moritz; Schröder-Preikschat, Wolfgang; German, Reinhard; Meyer-Wegener, Klaus (Proc. of 16. GI/ITG Fachtagung Kommunikation in Verteilten Systemen, 2009)
We present an integrated approach for supporting in-network sensor data processing in dynamic and heterogeneous sensor networks. The concept relies on data stream processing techniques that define and optimize the distribution of queries and their operators. We anticipate a high degree of dynamics and heterogeneity in the network, which is expected to be the case for wildlife monitoring applications. The distribution of operators to individual nodes demands several system level capabilities not available in current sensor node operating systems. In particular, we developed means for replacing software modules, i.e. small applications, on demand and without loss of status information. In order to facilitate this operation, we added a lightweight module support for the Nut/OS system and implemented a new memory management that uses tags for preserving state across module updates and node reboots.
UnivIS-Import:2015-04-16:Pub.2009.tech.IMMD.IMMD4._query
Keywords: RDSP

Ratcheta: Memory-bounded hybrid byzantine consensus for cooperative embedded systems - Xu, Wenbo; Kapitza, Rüdiger (Proceedings of the IEEE Symposium on Reliable Distributed Systems, 2019)
Cooperative autonomous systems gain increasing popularity nowadays. Most of these systems demand for high fault-resilience, otherwise a single faulty node could render the whole system useless. This essentially calls for a Byzantine fault-tolerant consensus. However, in such algorithms typically only [ n−1/ 3 ] faulty nodes can be tolerated in a group of n nodes and the message complexity is high. Even worse, systems with only 3 nodes are too small to even tolerate a single Byzantine node. In this work we present a novel consensus algorithm, RATCHETA. On the one hand it increases the maximum tolerable faulty nodes to [ n−1/ 2] and lowers the message complexity. This is achieved by assuming a hybrid fault model, which features the use of a small trusted subsystem that hosts a pair of monotonic counters for message authentication to prevent equivocation. Moreover, it can ensure an upper bound of the memory usage and message size, which is not addressed by most other hybrid consensus algorithms. On the other hand RATCHETA is tailored for wireless embedded systems. It uses multicast to reduce the communication overhead, and it does not rely on any packet loss detection or retransmission mechanisms. We implemented RATCHETA with its trusted subsystem built on top of ARM TrustZone. Our experimental results show that RATCHETA can tolerate both Byzantine faults and a certain amount of omission faults. With 20% message omissions, a 10-node group needs less than 1 second on average to reach a consensus. If 4 nodes out of 10 become Byzantine, the consensus latency is only about 1-3.6 seconds even under rough network conditions.
CRIS-Team Scopus Importer:2022-07-19
Keywords: Consensus; Distributed system; Fault-tolerance

RealSim: Real-time Mapping of Real World Sensor Deployments into Simulation Scenarios - Strübe, Moritz; Böhm, Simon; Kapitza, Rüdiger; Dressler, Falko (Proceedings of the 6th ACM international workshop on Wireless network testbeds, experimental evaluation and characterization (WiNTECH '11), 2011)
We present an approach to improve simulation results by automatically mapping the network topology of real wireless networks into a simulation environment. We basically target two problem domains: First, simulations are often used with rather arbitrary configurations, i.e., the used settings may strongly deviate from realistic setups. Secondly, and as our key motivation, we aim to use the simulator to experiment with different algorithms and settings in parallel to an existing sensor network installation. That means that we want to exactly rebuild the real network in order to estimate the performance of our new settings before deploying them into the network. In our demo, we show that not only the physical environment influences the propagation of radio waves, but also the hardware. These changes are incorporated in realtime into our simulator. Even though the reasons for the strong variations are out of the scope, the consequences for the sensor network are significant. © 2011 Authors.
UnivIS-Import:2015-04-16:Pub.2011.tech.IMMD.IMMD4.realsi
Keywords: RDSP

Recoverable Class Loaders for a Fast Restart of Java Applications - Kapitza, Rüdiger; et al. (Proceedings Mobilware 2008, 2008)
UnivIS-Import:2015-04-16:Pub.2008.tech.IMMD.IMMD4.recove
Keywords: Java; Virtual Machine; Snapshooting; Start-up Performance

Recoverable Class Loaders for a Fast Restart of Java Applications - Kapitza, Rüdiger; et al. (Mobile Networks & Applications, 2008)
UnivIS-Import:2015-04-14:Pub.2008.tech.IMMD.IMMD4.recove_0

Resource-efficient Byzantine Fault Tolerance - Distler, Tobias; Cachin, Christian; Kapitza, Rüdiger (IEEE Transactions on Computers, 2016)
UnivIS-Import:2015-10-26:Pub.2015.tech.IMMD.IMMD4.resour

Revisiting Fault-Injection Experiment-Platform Architectures - Schirmeier, Horst; Hoffmann, Martin; Kapitza, Rüdiger; Lohmann, Daniel; Spinczyk, Olaf (Proceedings of the 17th IEEE Pacific Rim International Symposium on Dependable Computing (PRDC '11), 2011)
Many years of research on dependable, fault-tolerant software systems yielded a myriad of tool implementations for vulnerability analysis and experimental validation of resilience measures. Trace recording and fault injection are among the core functionalities these tools provide for hardware debuggers or system simulators, partially including some means to automate larger experiment campaigns. We argue that current fault-injection tools are too highly specialized for specific hardware devices or simulators, and are developed in poorly modularized implementations impeding evolution and maintenance. In this article, we present a novel design approach for a fault-injection infrastructure that allows experimenting researchers to switch simulator or hardware back ends with little effort, fosters experiment code reuse, and retains a high level of maintainability. © 2011 IEEE.
UnivIS-Import:2015-04-16:Pub.2011.tech.IMMD.IMMD4.revisi_0
Keywords: dependability; fault-injection; DanceOS

Robust and Efficient Software Management in Sensor Networks - Schröder-Preikschat, Wolfgang; Kapitza, Rüdiger; Kleinöder, Jürgen; Felser, Meik; Karmeier, Katja; et al. (2nd IEEE/ACM International Conference on Communication System Software and Middleware (COMSWARE 2007), 2007)
Software deployment and updating of deployed code is a critical topic in the area of wireless sensor networks (WSN). Reasons are unreliable network connectivity, resource limitations of devices, and energy restrictions in general. Consequently, software deployment has to be performed with great care otherwise resources might be wasted or nodes become unavailable due to failed updates. The overall objective for software management in sensor networks is to enable a robust and efficient way to build deployable software images that take into account all the needs from application requirements to node-specific resource restrictions. In this article, we outline the current state-of-theart for software management in WSN and (network-based) sensor network (re-)programming. We provide insights into three different approaches enabling a more comprehensive management of WSN while challenging the robustness and efficiency of software configurations and reprogramming. Additionally, we outline research challenges in the area of software management and sensor network operation. © 2007 IEEE.
UnivIS-Import:2015-04-16:Pub.2007.tech.IMMD.IMMD4.robust
Keywords: RDSP

Rollback and Forking Detection for Trusted Execution Environments Using Lightweight Collective Memory - Brandenburger, Marcus; Cachin, Christian; Lorenz, Matthias; Kapitza, Rüdiger (Proceedings - 47th Annual IEEE/IFIP International Conference on Dependable Systems and Networks, DSN 2017, 2017)
Novel hardware-aided trusted execution environments, as provided by Intel's Software Guard Extensions (SGX), enable to execute applications in a secure context that enforces confidentiality and integrity of the application state even when the host system is misbehaving. While this paves the way towards secure and trustworthy cloud computing, essential system support to protect persistent application state against rollback and forking attacks is missing. In this paper we present LCM-a lightweight protocol to establish a collective memory amongst all clients of a remote application to detect integrity and consistency violations. LCM enables the detection of rollback attacks against the remote application, enforces the consistency notion of fork-linearizability and notifies clients about operation stability. The protocol exploits the trusted execution environment, complements it with simple client-side operations, and maintains only small, constant storage at the clients. This simplifies the solution compared to previous approaches, where the clients had to verify all operations initiated by other clients. We have implemented LCM and demonstrated its advantages with a key-value store application. The evaluation shows that it introduces low network and computation overhead, in particular, a LCM-protected key-value store achieves 0.72x-0.98x of an SGX-secured key-value store throughput.
CRIS-Team Scopus Importer:2022-07-19

Running ZooKeeper coordination services in untrusted clouds - Brenner, Stefan; Wulf, Colin; Kapitza, Rüdiger (10th Workshop on Hot Topics in System Dependability, HotDep 2014, 2014)
Cloud computing is a recent trend in computer science. However, privacy concerns and a lack of trust in cloud providers are an obstacle for many deployments. Maturing hardware support for implementing Trusted Execution Environments (TEEs) aims at mitigating these problems. Such technologies allow to run applications in a trusted environment, thereby protecting data from unauthorized access. To reduce the risk of security vulnerabilities, code executed inside a TEE should have a minimal Trusted Codebase. As a consequence, there is a trend for partitioning application's logic in trusted and untrusted parts. Only the trusted parts are executed inside the TEE handling the privacy-sensitive processing steps. In this paper, we add a transparent encryption layer to ZooKeeper by means of a privacy proxy supposed to run inside a TEE. We show what measures are necessary to split an application into a trusted and an untrusted part in order to protect the data stored inside, with Zoo- Keeper as an example. With our solution, ZooKeeper can be deployed at untrusted cloud providers, establishing confidential coordination for distributed applications. With our privacy proxy, all ZooKeeper functionality is retained while there is little degradation of throughput.
CRIS-Team Scopus Importer:2022-07-19

SAREK: Optimistic Parallel Ordering in Byzantine Fault Tolerance - Li, Bijun; Xu, Wenbo; Abid, Muhammad Zeeshan; Distler, Tobias; Kapitza, Rüdiger (Proceedings of the 12th European Dependable Computing Conference (EDCC '16), 2016)
UnivIS-Import:2016-06-01:Pub.2016.tech.IMMD.IMMD4.sareko
Keywords: REFIT

Scalable BFT for Multi-Cores: Actor-based Decomposition and Consensus-oriented Parallelization - Behl, Johannes; Distler, Tobias; Kapitza, Rüdiger (Proceedings of the 10th Workshop on Hot Topics in System Dependability (HotDep '14), 2014)
UnivIS-Import:2015-04-16:Pub.2014.tech.IMMD.IMMD4.scalab
Keywords: REFIT

SCONE: Secure linux containers with Intel SGX - Arnautov, Sergei; Trach, Bohdan; Gregor, Franz; Knauth, Thomas; Martin, Andre; Priebe, Christian; Lind, Joshua; Muthukumaran, Divya; O'Keeffe, Dan; Stillwell, Mark L.; Goltzsche, David; Eyers, David; et al. (Proceedings of the 12th USENIX Symposium on Operating Systems Design and Implementation, OSDI 2016, 2016)
In multi-tenant environments, Linux containers managed by Docker or Kubernetes have a lower resource footprint, faster startup times, and higher I/O performance compared to virtual machines (VMs) on hypervisors. Yet their weaker isolation guarantees, enforced through software kernel mechanisms, make it easier for attackers to compromise the confidentiality and integrity of application data within containers. We describe SCONE, a secure container mechanism for Docker that uses the SGX trusted execution support of Intel CPUs to protect container processes from outside attacks. The design of SCONE leads to (i) a small trusted computing base (TCB) and (ii) a low performance overhead: SCONE offers a secure C standard library interface that transparently encrypts/decrypts I/O data; to reduce the performance impact of thread synchronization and system calls within SGX enclaves, SCONE supports user-level threading and asynchronous system calls. Our evaluation shows that it protects unmodified applications with SGX, achieving 0.6×-1.2× of native throughput.
CRIS-Team Scopus Importer:2022-07-19

Secure cloud micro services using Intel SGX - Brenner, Stefan; Hundt, Tobias; Mazzeo, Giovanni; Kapitza, Rüdiger (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), 2017)
The micro service paradigm targets the implementation of large and scalable systems while enabling fine-grained service-level maintainability. Due to their scalability, such architectures are frequently used in cloud environments, which are often subject to privacy and trust issues hindering the deployment of services dealing with sensitive data. In this paper we investigate the integration of trusted execution based on Intel Software Guard Extensions (SGX) into micro service applications. We present our Vert.x Vault , that supports SGX-based trusted execution in Eclipse Vert.x, a renowned tool-kit for writing reactive micro service applications. With our approach, secure micro services can run alongside regular ones, inter-connected via the Vert.x event bus to build large Vert.x applications that can contain multiple trusted components. Maintaining a full-fledged Java Virtual Machine (JVM) inside an SGX enclave is impractical due to its complexity, less secure because of a large Trusted Code Base (TCB), and would suffer from performance penalties due to a high memory footprint. However, as Vert.x is written in Java, for a lean TCB this requires integration of native enclave C/C++ code into Vert.x, for which we propose the usage of Java Native Interface (JNI). Our Vert.x Vault provides the benefits of micro service architectures together with trusted execution to support privacy and data confidentiality for sensitive applications in the cloud at scale. In our evaluation we show the feasibility of our approach, buying a significantly increased level of security for a low performance overhead of only ≈8.7%.
CRIS-Team Scopus Importer:2022-07-19
Keywords: Cloud security; Micro services; SGX; Vert.x

SecureKeeper: Confidential ZooKeeper using Intel SGX - Brenner, Stefan; Wulf, Colin; Goltzsche, David; Weichbrodt, Nico; Lorenz, Matthias; Fetzer, Christof; Pietzuch, Peter; Kapitza, Rüdiger (Proceedings of the 17th International Middleware Conference, Middleware 2016, 2016)
Cloud computing, while ubiquitous, still suffers from trust issues, especially for applications managing sensitive data. Third-party coordination services such as ZooKeeper and Consul are fundamental building blocks for cloud applications, but are exposed to potentially sensitive application data. Recently, hardware trust mechanisms such as Intel's Software Guard Extensions (SGX) offer trusted execution environments to shield application data from untrusted software, including the privileged Operating System (OS) and hypervisors. Such hardware support suggests new options for securing third-party coordination services. We describe SecureKeeper, an enhanced version of the ZooKeeper coordination service that uses SGX to preserve the confidentiality and basic integrity of ZooKeeper-managed data. SecureKeeper uses multiple small enclaves to ensure that (i) user-provided data in ZooKeeper is always kept encrypted while not residing inside an enclave, and (ii) essential processing steps that demand plaintext access can still be performed securely. SecureKeeper limits the required changes to the ZooKeeper code base and relies on Java's native code support for accessing enclaves. With an overhead of 11%, the performance of SecureKeeper with SGX is comparable to ZooKeeper with secure communication, while providing much stronger security guarantees with a minimal trusted code base of a few thousand lines of code.
CRIS-Team Scopus Importer:2022-07-19
Keywords: Apache ZooKeeper; Cloud computing; Intel SGX

SEEP: Exploiting Symbolic Execution for Energy-Aware Programming - Hönig, Timo; Eibel, Christopher; Kapitza, Rüdiger; Schröder-Preikschat, Wolfgang (Proceedings of the 4th Workshop on Power-Aware Computing and Systems (HotPower 2011), 2011)
In recent years, there has been a rapid evolution of energy-aware computing systems (e.g., mobile devices, wireless sensor nodes), as still rising system complexity and increasing user demands make energy a permanently scarce resource. While static and dynamic optimizations for energy-aware execution have been massively explored, writing energy-efficient programs in the first place has only received limited attention. This paper proposes SEEP, a framework which exploits symbolic execution and platform-specific energy profiles to provide the basis for energy-aware programming. More specifically, the framework provides developers with information about the energy demand of their code at hand, even for the invocation of library functions and in settings with multiple possibly strongly heterogeneous target platforms. This equips developers with the necessary knowledge to take energy demand into account during the task of writing programs. © 2011 ACM.
UnivIS-Import:2015-04-16:Pub.2011.tech.IMMD.IMMD4.seepex

SEEP: Exploiting Symbolic Execution for Energy-Aware Programming - Hönig, Timo; Eibel, Christopher; Kapitza, Rüdiger; Schröder-Preikschat, Wolfgang (Best Papers from SOSP 2011 Workshops, 2012)
UnivIS-Import:2015-04-20:Pub.2012.tech.IMMD.IMMD4.seepex

Sgx-dl: Dynamic loading and hot-patching for secure applications: Experience paper - Weichbrodt, Nico; Heinemann, Joshua; Almstedt, Lennart; Aublin, Pierre Louis; Kapitza, Rüdiger (Middleware 2021 - Proceedings of the 22nd International Middleware Conference, 2021)
Trusted execution as offered by Intel's Software Guard Extensions (SGX) is considered as an enabler to protect the integrity and confidentiality of stateful workloads such as key-value stores and databases in untrusted environments. These systems are typically long running and require extension mechanisms built on top of dynamic loading as well as hot-patching to avoid downtimes and apply security updates faster. However, such essential mechanisms are currently neglected or even missing in combination with trusted execution. We present sgx-dl, a lean framework that enables dynamic loading of enclave code at the function level and hot-patching of dynamically loaded code. Additionally, sgx-dl is the first framework to utilize the new SGX version 2 features and also provides a versioning mechanism for dynamically loaded code. Our evaluation shows that sgx-dl introduces a performance overhead of less than 5% and shrinks application downtime by an order of magnitude in the case of a database system.
CRIS-Team Scopus Importer:2022-07-19
Keywords: dynamic code loading; hot-patching; Intel software guard extensions; trusted execution

SGXoMeter: Open and Modular Benchmarking for Intel SGX - Mahhouk, Mohammad; Weichbrodt, Nico; Kapitza, Rüdiger (EuroSec 2021 - Proceedings of the 14th European Workshop on Systems, 2021)
Intel's Software Guard Extensions (SGX) are currently the most wide-spread commodity trusted execution environment, which provides integrity and confidentiality of sensitive code and data. Thereby, it offers protection even against privileged attackers and various forms of physical attacks. As a technology that only became available in late 2015, it has received massive interest and undergone a rapid evolution. Despite first ad-hoc attempts, there is so far no standardised approach to benchmark the SGX hardware, its associated environment, and techniques that were designed to harden SGX-based applications. In this paper, we present SGXoMeter, an open and modular framework designed to benchmark different SGX-aware CPUs, μcode revisions, SDK versions and extensions to mitigate side-channel attacks. SGXoMeter provides a set of practical SGX test case scenarios and eases the development of custom benchmarks. Furthermore, we compare it to sgx-nbench, the only other SGX application benchmark tool we are aware of, and evaluate their differences. Through our benchmark results, we identified a performance overhead of up to ã10 times induced between two different SGX-SDK versions for certain workload scenarios.
CRIS-Team Scopus Importer:2022-07-19
Keywords: Benchmarking; SGX; Trusted Execution

SGX-Perf: A performance analysis tool for intel SGX enclaves - Weichbrodt, Nico; Aublin, Pierre-Louis; Kapitza, Rüdiger (Proceedings of the 19th International Middleware Conference, Middleware 2018, 2018)
Novel trusted execution technologies such as Intel’s Software Guard Extensions (SGX) are considered a cure to many security risks in clouds. This is achieved by offering trusted execution contexts, so called enclaves, that enable confidentiality and integrity protection of code and data even from privileged software and physical attacks. To utilise this new abstraction, Intel offers a dedicated Software Development Kit (SDK). While it is already used to build numerous applications, understanding the performance implications of SGX and the offered programming support is still in its infancy. This inevitably leads to time-consuming trial-and-error testing and poses the risk of poor performance. To enable the development of well-performing SGX-based applications, this paper makes the following three contributions: First, it summarises identified performance critical factors of SGX. Second, it presents sgx-perf , a collection of tools for high-level dynamic performance analysis of SGX-based applications. In particular, sgx-perf performs not only fined-grained profiling of performance critical events in enclaves but also offers recommendations on how to improve enclave performance. Third, it demonstrates how we used sgx-perf in four non-trivial SGX workloads to increase their performance by up to 2.16x.
CRIS-Team Scopus Importer:2022-07-19
Keywords: Intel software guard extensions; Performance profiling; Trusted execution

SoK: Scalability Techniques for BFT Consensus - Berger, Christian; Schwarz-Rüsch, Signe; Vogel, Arne; Bleeke, Kai; Jehl, Leander; Reiser, Hans P.; Kapitza, Rüdiger (Proceedings of the 5th IEEE International Conference on Blockchain and Cryptocurrency, 2023)
With the advancement of blockchain systems, many recent research works have proposed distributed ledger technology (DLT) that employs Byzantine fault-tolerant (BFT) consensus protocols to decide which block to append next to the ledger. Notably, BFT consensus can offer high performance, energy efficiency, and provable correctness properties, and it is thus considered a promising building block for creating highly resilient and performant blockchain infrastructures. Yet, a major ongoing challenge is to make BFT consensus applicable to large-scale environments. A large body of recent work addresses this challenge by developing novel ideas to improve the scalability of BFT consensus, thus opening the path for a new generation of BFT protocols tailored to the needs of blockchain. In this survey, we create a systematization of knowledge about the novel scalability-enhancing techniques that state-of-the-art BFT consensus protocols use. For our comparison, we closely analyze the efforts, assumptions, and trade-offs these protocols make.<br
Keywords: Byzantine Fault Tolerance; Consensus; Scalability; Blockchain

SPARE: Replicas on Hold - Distler, Tobias; Kapitza, Rüdiger; Popov, Ivan; Reiser, Hans; Schröder-Preikschat, Wolfgang (Proceedings of the 18th Network and Distributed System Security Symposium (NDSS '11), 2011)
UnivIS-Import:2015-04-16:Pub.2011.tech.IMMD.IMMD4.sparer
Keywords: REFIT

SplitBFT: Improving Byzantine Fault Tolerance Safety Using Trusted Compartments - Messadi, Ines; Becker, Markus Horst; Bleeke, Kai; Jehl, Leander; Mokhtar, Sonia Ben; Kapitza, Rüdiger (Middleware 2022 - Proceedings of the 23rd ACM/IFIP International Middleware Conference, 2022)
Byzantine fault-tolerant agreement (BFT) in a partially synchronous system usually requires 3f + 1 nodes to tolerate f faulty replicas. Due to their high throughput and finality property, BFT algorithms build the core of recent permissioned blockchains. As a complex and resource-demanding infrastructure, multiple cloud providers have started offering Blockchain-as-a-Service. This eases the deployment of permissioned blockchains but places the cloud provider in a central controlling position, thereby questioning blockchains' fault tolerance and decentralization properties and their underlying BFT algorithm. This paper presents SplitBFT, a new way to utilize trusted execution technology (TEEs), such as Intel SGX, to harden the safety and confidentiality guarantees of BFT systems, thereby strengthening the trust in could-based deployments of permissioned blockchains. Deviating from standard assumptions, SplitBFT acknowledges that code protected by trusted execution may fail. We address this by splitting and isolating the core logic of BFT protocols into multiple compartments resulting in a more resilient architecture. We apply SplitBFT to the traditional practical byzantine fault tolerance algorithm (PBFT) and evaluate it using SGX. Our results show that SplitBFT adds only a reasonable overhead compared to the non-compartmentalized variant.
CRIS-Team Scopus Importer:2022-07-19
Keywords: Byzantine Fault Tolerance; Intel SGX; Safety

STANlite - A database engine for secure data processing at rack-scale level - Sartakov, Vasily A.; Weichbrodt, Nico; Krieter, Sebastian; Leich, Thomas; Kapitza, Rüdiger (Proceedings - 2018 IEEE International Conference on Cloud Engineering, IC2E 2018, 2018)
Intel's novel Software Guard eXtensions (SGX) enable secure and trusted execution of services, thereby paving the way to outsource sensitive data processing to external data centers. While SGX promises trusted execution close to native speed, frequent I/O operations and memory usage beyond a hardware-dependent threshold of currently 92 MiB result in substantial performance degradation. For memory-intensive workloads such as key-value stores and databases these penalties can be prohibitively high. We present STANlite - an in-memory database engine for SGX-enabled secure data processing in rack-scale environments. STANlite performs efficient user-level paging, whenever a database workload requires more space than the performance-friendly in-memory state size. Furthermore, STANlite smartly combines the properties of Remote Direct Memory Access (RDMA) and SGX to reduce the overhead of network-based I/O operations. While SGX usually provides confidentiality and integrity at the same time, STANlite enables a purely integrity preserving data management mode for additional performance. Finally, STANlite features a small trusted computing base and is memory-efficient, as it extends SQLite, a database for embedded use. We evaluated STANlite in terms of query response time. It outperforms a vanilla SGX-based SQLite version by 1.79x for microbenchmarks and 2.44x for TPC-C.
CRIS-Team Scopus Importer:2022-07-19
Keywords: Database; Memory encryption; SGX

Stateful Mobile Modules for Sensor Networks - Strübe, Moritz; Kapitza, Rüdiger; Stengel, Klaus; Daum, Michael; Dreßler, Falko (Distributed Computing in Sensor Systems (6th IEEE International Conference, DCOSS 2010, Proceedings), 2010)
Most sensor network applications are dominated by the acquisition of sensor values. Due to energy limitations and high energy costs of communication, in-network processing has been proposed as a means to reduce data transfers. As application demands may change over time and nodes run low on energy, get overloaded, or simply face debasing communication capabilities, runtime adaptation is required. In either case, it is useful to be able to migrate computations between neighboring nodes without losing runtime state that might be costly or even impossible to recompute. We propose stateful mobile modules as a basic infrastructure building block to improve adaptiveness and robustness of in-network processing applications. Stateful mobile modules are binary modules linked on the node itself. Even more importantly, they can be transparently migrated from one node to another, thereby keeping statically as well as dynamically allocated memory. This is achieved by an optimized binary format, a memory-efficient linking process and an advanced programming support. © 2010 Springer-Verlag.
UnivIS-Import:2015-04-16:Pub.2010.tech.IMMD.IMMD4.statef
Keywords: RDSP

State Transfer for Hypervisor-Based Proactive Recovery of Heterogeneous Replicated Services - Distler, Tobias; Kapitza, Rüdiger; Reiser, Hans P. (Proceedings of the 5th "Sicherheit, Schutz und Zuverlässigkeit" Conference (SICHERHEIT '10), 2010)
Intrusion-tolerant replication enables the construction of systems that tolerate a finite number of malicious faults. An arbitrary number of faults can be tolerated during system lifetime if faults are eliminated periodically by proactive recovery. The periodic rejuvenation of stateful replicas requires the transfer and validation of the replica state. This paper presents two novel efficient state transfer protocols for a hypervisor-based replication architecture that supports proactive recovery. Our approach handles heterogeneous replicas, and allows changing/updating the replica implementation on each recovery. We harness virtualization for an efficient state transfer between "old" and "new" replicas in virtual machines on the same physical host, and use copy-on-write disk snapshots for low-intrusive recovery of replicas in parallel with service execution. We apply the generic algorithm to a realistic three-tier application (RUBiS) and study the impact of recovery and state transfer on system performanc
UnivIS-Import:2015-04-16:Pub.2010.tech.IMMD.IMMD4.statet
Keywords: REFIT

Storyboard: Optimistic Deterministic Multithreading - Kapitza, Rüdiger; Schunter, Matthias; Cachin, Christian; Stengel, Klaus; Distler, Tobias (Proceedings of the 6th Workshop on Hot Topics in System Dependability (HotDep '10), 2010)
UnivIS-Import:2015-04-16:Pub.2010.tech.IMMD.IMMD4.storyb
Keywords: TCLOUDS; REFIT

Study on performance-centric offload strategies for LTE networks - Hagos, Desta Haileselassie; Kapitza, Rüdiger (Proceedings of 2013 6th Joint IFIP Wireless and Mobile Networking Conference, WMNC 2013, 2013)
Currently, cellular networks are overloaded with mobile data traffic due to the rapid growth of mobile broadband subscriptions and the increasing popularity of applications for smartphones. One possible solution to alleviate this problem is the offloading of mobile data traffic from the primary access technology to the WiFi infrastructure to gain extra capacity and improve the overall network performance. As the strategy what and when to offload data is non-trivial, it is of vital importance to develop novel algorithms to guide this process. This paper addresses solutions for WiFi offloading in Long Term Evolution (LTE) cellular networks when performance needs exceed the capability of the LTE access. It then compares the performance of each access technology using different network performance metrics. In detail, an optimized Signal-to-noise ratio (SNR)-threshold based handover solution and extension to the 3rd Generation Partnership Project (3GPP) standard for Access Network Discovery and Selection Function (ANDSF) framework for WiFi offloading is proposed. Our simulation results have shown that ANDSF discovery can be used to control the amount of offloading. © 2013 IEEE.
CRIS-Team Scopus Importer:2022-07-19
Keywords: Access Selection; ANDSF; IEEE 802.11; LTE; multi-access; Offloading; Seamless Handover; WiFi Access Points

SURESOFT: Towards Sustainable Research Software - Blech, Christopher; Dreyer, Nils; Friebel, Björn; R. Jacob, Christoph; Shamil Jassim, Mostafa; Jehl, Leander; Kapitza, Rüdiger; Krafczyk, Manfred; Kürner, Thomas; C. Langer, Sabine; Linxweiler, Jan; Mahhouk, Mohammad; et al. (2022)
Researchers develop software to process or generate data to test their scientific hypotheses. Especially researchers from STEM disciplines (Science, Technology, Engineering, and Mathematics) validate their models through self-developed software prototypes. However, they do not necessarily have a programming or software engineering background. Moreover, scientific software development happens in a time-constrained environment focusing on the fast publication of results. In addition, as scientists usually have limited contracts, the software is developed with short-term goals in mind. Therefore, the resulting software is mostly rapidly developed and contains code artifacts that are hard to maintain, extend and even reproduce due to missing documentation or dependencies. These factors, among others, hinder researchers from progressing and further developing their software. Thus, research software sustainability is vital to the research process to ensure that software can be evolved and reused by the next generation of scientists. To foster sustainability, scientists can highly benefit from education in principles and practices of software engineering, which can further be supported by established methods, tools, and technologies. This paper introduces SURESOFT, a twofold approach to address challenges in the development of research software regarding sustainable science that combines tools and infrastructure with education in the form of workshops and training. Furthermore, we report our experience of applying the SURESOFT approach to five software projects from different fields and discuss challenges, such as common bad practices and applicability in diverse scenarios. </

TEE-Assisted Recovery and Upgrades for Long-Running BFT Services - Messadi, Ines; Gerber, Markus Elias; Distler, Tobias; Kapitza, Rüdiger (Proceedings of the 20th International Conference on Availability, Reliability and Security (ARES '25), 2025)

Telling your secrets without page faults: Stealthy page table-based attacks on enclaved execution - Van Bulck, Jo; Weichbrodt, Nico; Kapitza, Rüdiger; Piessens, Frank; Strackx, Raoul (Proceedings of the 26th USENIX Security Symposium, 2017)
Protected module architectures, such as Intel SGX, enable strong trusted computing guarantees for hardware-enforced enclaves on top a potentially malicious operating system. However, such enclaved execution environments are known to be vulnerable to a powerful class of controlled-channel attacks. Recent research convincingly demonstrated that adversarial system software can extract sensitive data from enclaved applications by carefully revoking access rights on enclave pages, and recording the associated page faults. As a response, a number of state-of-the-art defense techniques has been proposed that suppress page faults during enclave execution. This paper shows, however, that page table-based threats go beyond page faults. We demonstrate that an untrusted operating system can observe enclave page accesses without resorting to page faults, by exploiting other side-effects of the address translation process. We contribute two novel attack vectors that infer enclaved memory accesses from page table attributes, as well as from the caching behavior of unprotected page table memory. We demonstrate the effectiveness of our attacks by recovering EdDSA session keys with little to no noise from the popular Libgcrypt cryptographic software suite.
CRIS-Team Scopus Importer:2022-07-19

Temporality a NVRAM-based Virtualization Platform - Sartakov, Vasily A.; Martens, Arthur; Kapitza, Rüdiger (Proceedings of the IEEE Symposium on Reliable Distributed Systems, 2016)
Power failures in data centers and Cloud Computing infrastructures can cause loss of data and impact revenue. Existing best practice such as persistent logging and checkpointing add overhead during operation and increase recovery time. Other solutions like the use of an uninterruptable power supply incur additional costs and are maintenance-intensive. Novel persistent main memory, i.e. memory that retains stored data without an external source of power, firstly prevents data loss in case of a power outage, secondly reduces the time for a system reboot and thirdly enables to continue operation at full-speed after a recovery. Yet new architectures and programming models are required to utilize persistent main memory. We present Temporality a virtualization layer that runs virtual machines in persistent memory and offers virtual persistent memory. It can be used as a basis for future Cloud platforms to allow applications the utilization of persistent memory without any changes. It provides safety of volatile data, significantly decreases overall recovery time and prevents subsequent performance degradation.
CRIS-Team Scopus Importer:2022-07-19
Keywords: Cloud Computing; NVRAM; Virtualization

THEMIS: An efficient and memory-safe BFT framework in rust research statement - Rüsch, Signe; Bleeke, Kai; Kapitza, Rüdiger (SERIAL 2019 - Proceedings of the 2019 3rd Workshop on Scalable and Resilient Infrastructures for Distributed Ledgers, 2019)
Byzantine fault tolerant (BFT) protocols have previously been developed mainly in C or Java. C offers high performance but is more error-prone, leading to more potential Byzantine faults, whereas Java offers memory safety at the cost of performance. The Rust programming language combines the performance advantages of C with safe memory management, and newer releases now enable the implementation of complex, non-blocking asynchronous frameworks, as is needed for efficient BFT frameworks. We present a BFT framework implementation in Rust and preliminary performance evaluations for the PBFT protocol.
CRIS-Team Scopus Importer:2022-07-19
Keywords: Blockchain; Byzantine fault tolerance; Rust

Themis: An Efficient and Memory-Safe BFT Framework in Rust (Research Statement) - Schwarz-Rüsch, Signe; Bleeke, Kai; Kapitza, Rüdiger (3rd Workshop on Scalable and Resilient Infrastructures for Distributed Ledgers (SERIAL 2019), 2019)
Byzantine fault tolerant (BFT) protocols have previously been developed mainly in C or Java. C offers high performance but is more error-prone, leading to more potential Byzantine faults, whereas Java offers memory safety at the cost of performance. The Rust programming language combines the performance advantages of C with safe memory management, and newer releases now enable the implementation of complex, non-blocking asynchronous frameworks, as is needed for efficient BFT frameworks. We present a BFT framework implementation in Rust and preliminary performance evaluations for the PBFT protocol.<br
Keywords: Rust; blockchain; Byzantine fault tolerance

The neverending runtime: Using new technologies for ultra-low power applications with an unlimited runtime - Cassens, Björn; Martens, Arthur; Kapitza, Rüdiger (International Conference on Embedded Wireless Systems and Networks, 2016)
Many wireless sensor network scenarios dictate tight node size and weight limits. Still a long, if possible infinite, mission lifetime is demanded. To fulfill these contradicting requirements, we propose ECON1 a tailored combination of an energy harvesting device with a new nano-power sleep mode that requires near zero power and preserves the application state. An operating system agnostic system software layer combined with NVRAM enables lightweight mode transitions between nano-power sleep mode and normal operation. Furthermore, by introducing a new ultra-low power management circuit we can tolerate power outages that may occur when the power consumption outperforms the harvested energy. ECON has been evaluated using a Texas Instruments MSP430 node equipped with non-volatile FeRAM. Our nano-power sleep mode drains 3.7 times less power than the best onboard available sleep mode. Entering and leaving this mode is worthwhile when the microcon-troller idles for more than 1.01 ms.
CRIS-Team Scopus Importer:2022-07-19
Keywords: Energy Aware Systems; Energy Harvesting; Firmware; Operating Systems; Power Outages; Wearable

Thinking small: next-generation sensor networks close the size gap in vertebrate biologging - Ripperger, Simon; Carter, Gerald; Page, Rachel; Duda, Niklas; Kölpin, Alexander; Weigel, Robert; Hartmann, Markus; Nowak, Thorsten; Thielecke, Jörn; Schadhauser, Michael; Robert, Jörg; Herbst, Sebastian; et al. (Plos Biology, 2020)

Towards a Blockchain-based Data Recorder for Small Drones - Böhm, Harald; Distler, Tobias; Kapitza, Rüdiger (2nd Workshop on Resilient Operations – Byzantine Fault Tolerance and State-Machine Replication (ROBUST '25), 2025)
Building a reliable and tamper-resistant flight data recorder for small drones is a task that comes with unprecedented requirements in terms of robustness, resource efficiency and weight. In this paper, we report on our ongoing efforts to solve the associated problems by developing a solution that records all relevant information (e.g., positional data) in an on-board permissioned blockchain. The proposed system, through physical replication, aims to achieve data persistence despite catastrophic events such as a drone crash. All recorded data is replicated across three nodes and kept consistent by a Byzantine fault-tolerant (BFT) protocol. Leveraging the specific properties of our hardware setting, this protocol does not implement full-fledged BFT consensus, but instead relies on a tailored reliable-broadcast mechanism optimized for memory efficienc

Towards Low-Latency Byzantine Agreement Protocols Using RDMA - Schwarz-Rüsch, Signe; Messadi, Ines; Kapitza, Rüdiger (Proceedings - 48th Annual IEEE/IFIP International Conference on Dependable Systems and Networks Workshops, DSN-W 2018, 2018)
Byzantine fault tolerance (BFT) protocols can mitigate attacks and errors and are increasingly investigated as consensus protocols in blockchains. However, they are traditionally considered costly in terms of message complexity and latency due to the required multiple rounds of message exchanges. With the availability of Remote Direct Memory Access (RDMA) in data centers, message exchange latency can be reduced compared to TCP, as RDMA enables kernel bypassing and thereby avoids intermediate data copying. Retaining the performance benefits for RDMA during its integration, however, is non-trivial and error-prone. While the use of RDMA has previously been explored for key/value stores, databases and distributed file systems, agreement protocols especially for BFT have so far been neglected. We investigate the usage of RDMA in the Reptor BFT protocol for low-latency agreement and show first steps towards an RDMA-enabled consensus protocol. For this, we present Rubin, a framework offering similar functionality to the Java NIO selector, which can handle multiple network connections efficiently with a single thread and is employed in several BFT protocol implementations such as BFT-SMaRt and UpRight.
CRIS-Team Scopus Importer:2022-07-19
Keywords: Blockchain Consensus; Byzantine Fault Tolerance; Remote Direct Memory Access

Towards secure dynamic product lines in the cloud - Krieter, Sebastian; Krueger, Jacob; Weichbrodt, Nico; Sartakov, Vasily A.; Leich, Thomas; Kapitza, Rüdiger (Proceedings - International Conference on Software Engineering, 2018)
Cloud-based technologies play an increasing role in software engineering because of their scalability, availability, and cost efficiency. However, due to privacy issues, developers and organizations still hesitate to host applications that handle sensitive data on servers of external cloud providers. Modern hardware extensions, such as Intel's Software Guard Extensions (SGX), are an attempt to provide confidentiality and integrity for applications running on external hardware. Still, enabling SGX in cloud systems poses new challenges considering scalability and flexibility. In this paper, we propose an approach to address these issues by employing concepts from the domain of Dynamic Software Product Lines (DSPLs). We aim to enable applications running on SGX-based cloud systems to be securely reconfigurable and extendable during runtime. In particular, we describe properties that such an approach should fulfill and discuss corresponding challenges.
CRIS-Team Scopus Importer:2022-07-19
Keywords: Cloud computing; Security; SGX; Software product line

TrApps: Secure compartments in the evil cloud - Brenner, Stefan; Goltzsche, David; Kapitza, Rüdiger (Proceedings of the 1st International Workshop on Security and Dependability of Multi-Domain Infrastructures, XDOM0 2017 - Co-located with European Conference on Computer Systems, EuroSys 2017, 2017)
The cloud computing paradigm enables the flexible and scalable outsourcing of workloads. However, cloud customers are often reluctant to entrust their sensitive data with cloud providers. This is due to the fact that the infrastructure is owned by another company and a resulting loss of control. With the recent advent of powerful ARM hardware targeted for data centres, there is the opportunity of using trusted execution technology provided by ARM TrustZone to enhance the protection of cloud customer's data. In this paper we propose TrApps, a secure platform for general-purpose trusted execution in an untrusted cloud with multiple isolated tenants based on the ARM TrustZone technology. Our system targets the parallel execution of partitioned applications of distinct tenants with lean security-sensitive components, and is based on a minimal trusted code base in the secure world of ARM TrustZone when compared to similar systems. In our evaluation we show the feasibility of our approach, and demonstrate its performance with trusted execution of memcached with an overhead of only 36:9% compared to the vanilla implementation and execution.
CRIS-Team Scopus Importer:2022-07-19
Keywords: ARM TrustZone; Cloud computing; Trusted execution

Troxy: Transparent Access to Byzantine Fault-Tolerant Systems - Li, Bijun; Weichbrodt, Nico; Behl, Johannes; Aublin, Pierre-Louis; Distler, Tobias; Kapitza, Rüdiger (Proceedings of the 48th International Conference on Dependable Systems and Networks (DSN '18), 2018)
Various protocols and architectures have been proposed to make Byzantine fault tolerance (BFT) increasingly practical. However, the deployment of such systems requires dedicated client-side functionality. This is necessary as clients have to connect to multiple replicas and perform majority voting over the received replies to outvote faulty responses. Deploying custom client-side code is cumbersome, and often not an option, especially in open heterogeneous systems and for well-established protocols (e.g., HTTP and IMAP) where diverse client-side implementations co-exist. We propose Troxy, a system which relocates the BFT-specific client-side functionality to the server side, thereby making BFT transparent to legacy clients. To achieve this, Troxy relies on a trusted subsystem built upon hardware protection enabled by Intel SGX. Additionally, Troxy reduces the replication cost of BFT for read-heavy workloads by offering an actively maintained cache that supports trustworthy read operations while preserving the consistency guarantees offered by the underlying BFT protocol. A prototype of Troxy has been built and evaluated, and results indicate that using Troxy (1) leads to at most 43% performance loss with small ordered messages in a local network environment, while (2) improves throughput by 130% with read-heavy workloads in a simulated wide-area network.
UnivIS-Import:2018-09-06:Pub.2018.tech.IMMD.IMMD4.troxyt
Keywords: REFIT

Trusted computing meets blockchain: Rollback attacks and a solution for hyperledger fabric - Brandenburger, Marcus; Cachin, Christian; Sorniotti, Alessandro; Kapitza, Rüdiger (Proceedings of the IEEE Symposium on Reliable Distributed Systems, 2019)
A smart contract on a blockchain cannot keep a secret because its data is replicated on all nodes in a network. To remedy this problem, it has been suggested combining blockchains with trusted execution environments (TEEs), such as Intel SGX, for executing applications that demand confidentiality. As a consequence, untrusted blockchain nodes cannot get access to the data and computations inside the TEE. This paper first explores issues that arise from the combination of TEEs with blockchains: Smart contracts executed inside TEEs are susceptible to rollback attacks, which should be prevented to maintain confidentiality for the application. However, in blockchains with non-final consensus protocols, such as the proof-of-work in Ethereum and others, the contract execution must handle rollbacks by design. This implies that TEEs for securing smart-contract execution cannot be directly used for such blockchains; this approach works only when the consensus decisions are final. Second, this work introduces an architecture and a prototype for smart-contract execution within Intel SGX for Hyperledger Fabric, a prominent enterprise blockchain platform. Our system resolves additional difficulties posed by the specific execute-order-validate architecture of Fabric, prevents rollback attacks on TEE-based execution as far as possible, and minimizes the trusted computing base. For increasing security, our design encapsulates each application on the blockchain within its own enclave that shields it from the host system. An evaluation shows that the overhead of moving the execution into SGX is within 10%-20% for a sealed-bid auction application.
CRIS-Team Scopus Importer:2022-07-19
Keywords: Blockchain; Hyperledger fabric; Intel SGX; Smart contract; TEE; Trusted computing

Trusted execution, and the impact of security on performance - Brenner, Stefan; Behlendorf, Michael; Kapitza, Rüdiger (Proceedings of the ACM Conference on Computer and Communications Security, 2018)
Due to increasing success of cloud computing offerings, the demand for sensitive data processing and security in the cloud has also increased. By incorporation of trusted execution technologies such as the broadly available Intel Software Guard Extensions (SGX), applications can be secured. However, software engineers need to align the development process with the capabilities and properties of such a technology, in order to correctly secure applications while achieving good performance. In this paper, we identify relevant aspects for partitioning applications and discuss two complementary designs optimising for performance or security respectively. Additionally, our contribution comprises a performance and security measurement, at the example of two established real-world applications, that we both partitioned according to the above two distinct design approaches. We consider this paper as a guideline for the partitioning process of mainly data-handling services for usage of trusted execution and as a collection of relevant characteristics during the development of applications with trusted execution environments.
CRIS-Team Scopus Importer:2022-07-19
Keywords: Application partitioning; Intel SGX

TrustJS: Trusted client-side execution of javascript - Goltzsche, David; Wulf, Colin; Muthukumaran, Divya; Rieck, Konrad; Pietzuch, Peter; Kapitza, Rüdiger (Proceedings of the Proceedings of the 10th European Workshop on Systems Security, EuroSec 2017, co-located with European Conference on Computer Systems, EuroSys 2017, 2017)
Client-side JavaScript has become ubiquitous in web applications to improve user experience and reduce server load. However, since clients are untrusted, servers cannot rely on the confidentiality or integrity of client-side JavaScript code and the data that it oper- ates on. For example, client-side input validation must be repeated at server side, and confidential business logic cannot be offloaded. In this paper, we present TRUSTJS, a framework that enables trust- worthy execution of security-sensitive JavaScript inside commodity browsers. TRUSTJS leverages trusted hardware support provided by Intel SGX to protect the client-side execution of JavaScript, en- abling a flexible partitioning of web application code. We present the design of TRUSTJS and provide initial evaluation results, show- ing that trustworthy JavaScript offloading can further improve user experience and conserve more server resources.
CRIS-Team Scopus Importer:2022-07-19
Keywords: Intel SGX; JavaScript; Trusted Clients; Trusted Computing

Trust more, serverless - Brenner, Stefan; Kapitza, Rüdiger (SYSTOR 2019 - Proceedings of the 12th ACM International Systems and Storage Conference, 2019)
The increasingly popular and novel Function-as-a-Service (FaaS) clouds allow users the deployment of single functions. Compared to Infrastructure-as-a-Service or Platform-as-a-Service, this enables providers even more aggressive and rigorous resource sharing and liberates customers from tedious maintenance tasks. However, as a crucial factor of cloud adoption, FaaS clouds need to provide security and privacy guarantees in order to allow sensitive data processing. In this paper, we investigate securing FaaS clouds for sensitive data processing, while respecting their new features, capabilities and benefits in a technology-aware manner. We start with the proposal of a generic approach for a JavaScript-based secure FaaS platform, then get more specific and discuss the implementation of two distinct approaches based on (a) a lightweight and (b) a high performance JavaScript engine. Our prototype implementation shows promising performance while efficiently utilising resources, thereby keeping the penalties of the added security low.
CRIS-Team Scopus Importer:2022-07-19
Keywords: Intel SGX; Serverless cloud; Trusted function-as-a-service

Trustworthy confidential virtual machines for the masses - Galanou, Anna; Bindlish, Khushboo; Preibsch, Luca; Pignolet, Yvonne-Anne; Fetzer, Christof; Kapitza, Rüdiger (24th ACM/IFIP International Middleware Conference, Middleware 2023, 2023)
Keywords: TLS; Attestation; AMD SEV-SNP; TEEs; Confidential Computing

Using Erasure Codes to Overcome Reliability Issues in Energy-Constrained Sensor Networks - Mutschlechner, Margit; Li, Bijun; Kapitza, Rüdiger; Dressler, Falko (Proceedings of the 11th IEEE/IFIP Conference on Wireless On demand Network Systems and Services (WONS 2014), 2014)
We study the use of Erasure Codes (ECs) for transmitting information from mobile sensor nodes to stationary base stations. In particular, we are interested in improving the overall communication reliability of the wireless communication. Our scenario is wildlife monitoring in which bats are equipped with tiny sensor nodes, just being capable to store a few kB of data and to exchange information over a wireless communication link. This link is used, on the one hand, for determining contact times between individuals. On the other hand, these contacts are communicated in aggregated form to stationary base stations. Since the channel quality may vary quickly due to the continuous movements of bats and the heterogeneous environment, the communication is in general assumed to be highly unreliable. Conventional reliability improving approaches such as full data replication or on-demand retransmission are too expensive or even not possible due to very strict energy constraints and asymmetric channels. ECs allow to enhance the reliability of data transmissions by transmitting redundant data. In this work, we investigate the trade-off between reliability achieved and the cost in form of additional transmissions, i.e., the additional energy costs. Our results clearly show that ECs improve the communication reliability considerably with almost no impact on the resulting delay. © 2014 IEEE.
UnivIS-Import:2015-04-16:Pub.2014.tech.IMMD.IMMD4.usinge_0

Vampire Bats that Cooperate in the Lab Maintain Their Social Networks in the Wild - Ripperger, Simon; Carter, Gerald; Duda, Niklas; Kölpin, Alexander; Cassens, Björn; Josic, Darija; Berrío-Martínez, Jineth; Page, Rachel; Mayer, Frieder; Kapitza, Rüdiger (Current Biology, 2019)

VeriFence: Lightweight and Precise Spectre Defenses for Untrusted Linux Kernel Extensions - Gerhorst, Luis; Herzog, Henriette; Wägemann, Peter; Ott, Maximilian; Kapitza, Rüdiger; Hönig, Timo (Proceedings of the 27th International Symposium on Research in Attacks, Intrusions and Defenses, RAID, 2024)
High-performance IO demands low-overhead communication between user- and kernel space. This demand can no longer be fulfilled by traditional system calls. Linux’s extended Berkeley Packet Filter (BPF) avoids user-/kernel transitions by just-in-time compiling user-provided bytecode and executing it in kernel mode with near-native speed. To still isolate BPF programs from the kernel, they are statically analyzed for memory- and type-safety, which imposes some restrictions but allows for good expressiveness and high performance. However, to mitigate the Spectre vulnerabilities disclosed in 2018, defenses which reject potentially-dangerous programs had to be deployed. We find that this affects 31% to 54% of programs in a dataset with 844 real-world BPF programs from popular open-source projects. To solve this, users are forced to disable the defenses to continue using the programs, which puts the entire system at risk. To enable secure and expressive untrusted Linux kernel extensions, we propose VeriFence, an enhancement to the kernel’s Spectre defenses that reduces the number of BPF application programs rejected from 54% to zero. We measure VeriFence’s overhead for all mainstream performance-sensitive applications of BPF (i.e., event tracing, profiling, and packet processing) and find that it improves significantly upon the status-quo where affected BPF programs are either unusable or enable transient execution attacks on the kernel.<br

Vivisecting the Dissection: On the Role of Trusted Components in BFT Protocols - Bessani, Alysson; Correia, Miguel; Distler, Tobias; Kapitza, Rüdiger; Esteves-Veríssimo, Paulo; Yu, Jiangshan (2023)

Where are the Joules? Energy Demand Analysis of Heterogeneous Memory Technologies - Preisner, Thomas; Nguyen, Dustin Tien; Vögele, Manuel; Szymanski, Matthias; Hönig, Timo; Kapitza, Rüdiger; Schröder-Preikschat, Wolfgang (4th Workshop on Heterogeneous Composable and Disaggregated Systems, 2025)
New heterogeneous memory architectures are emerging with the increasing availability of different memory technologies. The growing number of byte-addressable memory technologies (e.g., NVRAM and CXL) make the selection of components for concrete systems increasingly difficult, as each memory technology has specific advantages and disadvantages. Currently, decisions are made based on a variety of performance measurements and recommendations with respective implementation guidelines. However, traditional performance metrics often overlook the unique energy-demand dynamics of each specific memory technology, especially with diverse memory access patterns and workloads. This paper highlights the importance of memory utilization with different technologies and their environmental impact (i.e., energy demand). To this end, we present meBench – a benchmark generator that systematically quantifies the (non-uniform) energy demand of different memory types. We reveal the relevance of the generated results by contrasting them with the assumptions made in previous research on carbon-aware memory allocatio
Keywords: Memory Technologies; Energy Consumption; Benchmarking; Heterogeneous Systems; DRAM; Non-Volatile Memory; Optane; CXL

Worst-Case Energy Consumption Analysis for Energy-Constrained Embedded Systems - Wägemann, Peter; Distler, Tobias; Hönig, Timo; Janker, Heiko; Kapitza, Rüdiger; Schröder-Preikschat, Wolfgang (Proceedings of the 27th Euromicro Conference on Real-Time Systems (ECRTS '15), 2015)
UnivIS-Import:2015-04-17:Pub.2015.tech.IMMD.IMMD4.worstc

Worst-Case Energy Consumption Analysis for Soft and Hard Energy Systems - Wägemann, Peter; Hönig, Timo; Kapitza, Rüdiger; Schröder-Preikschat, Wolfgang (Proceedings of the 11th USENIX Symposium on Operating Systems Design and Implementation (OSDI 2014), Poster Session, 2014)
UnivIS-Import:2015-04-16:Pub.2014.tech.IMMD.IMMD4.worstc

ZugChain: Blockchain-Based Juridical Data Recording in Railway Systems - Schwarz-Rüsch, Signe; Bleeke, Kai; Messadi, Ines; Schmidt, Stefan; Krampf, Andreas; Olze, Katharina; Stahnke, Susanne; Schmid, Robert; Pirl, Lukas; Kittel, Roland; Polze, Andreas; Franz, Marquart; et al. (Proceedings of the 52nd International Conference on Dependable Systems and Networks, 2022)
In modern trains, a juridical recording unit logs events that occur during operation. This data is used to reconstruct the exact chain of events in case of failures and crashes. To ensure data recovery after an accident, the recorder is hardened against physical damage and secured against tampering; however, it is a single proprietary device and by no means indestructible. This paper presents ZugChain, a distributed, blockchain-based juridical recording unit that opportunistically utilizes on-train hardware. ZugChain offers high reliability via replication and tamper-resistance due to the nature of blockchains. It implements a permissioned blockchain based on a Byzantine fault-tolerant agreement protocol suitable for diverse communication systems. To utilize the logged data for advanced services, e. g., predictive maintenance, ZugChain securely and continuously exports traces to private data centers. We demonstrate ZugChain's feasibility with an implementation running on real train hardware, where we show that ZugChain orders data within 14 ms using at maximum 15 % of the total available shared CPU resources, thus fulfilling requirements of juridical recorder
Keywords: railway; BFT; event recorder; blockchain