3篇
您的检索式：作者名="Binyu ZANG"
|
|
|
题名
|
作者
|
年代
|
出处
|
被引量
|
| 1 | TZ-Container:protecting container from untrusted OS with ARM TrustZone显示文摘Containers are widely deployed on cloud platforms because of their low resource footprint, fast start-up time, and high performance, especially compared with their counterpart virtual machines. However,the Achilles’ heel of container technology is its weak isolation. For an attacker, jailbreaking into a host OS from a container is easier than attacking a hypervisor from a virtual machine, because of its notably larger attack surface and larger trusted computing base(TCB). Researchers have proposed various solutions to protect applications from untrusted OS;yet, few of them focus on protecting containers, especially those hosting multiple applications and shared by multiple users. In this paper, we first identify several new attacks that cannot be prevented using the existing solutions. Furthermore, we systematically analyze the security properties that should be maintained to defend against these attacks and protect a full-fledged container from a malicious host OS. We then present the TZ-Container, a TrustZone-based secure container mechanism that can keep all these security properties. The TZ-Container specifically leverages TrustZone to construct multiple isolated execution environments(IEEs). Each IEE has a memory space isolated from the underlying OS and any other processes. By interposing switching between the user and the kernel modes,IEEs enforce security checks on each system call according to its semantics. We have implemented TZContainer on the Hikey development board ensuring that it can support running unmodified Docker images downloaded from existing repositories such as http://gffzzb700e51cfd45483bsw9bx5fbnkxck6f5q.ffgz.tsg.suse.edu.cn/. The evaluation results demonstrate that the TZ-Container has a performance overhead of approximately 5%. | Zhichao HUA Yang YU Jinyu GU Yubin XIA Haibo CHEN Binyu ZANG | 2021 | Science China(Information Sciences)2021，64，9： | 1 |
| 2 | 'A Web service-based framework for supply chain management'显示文摘 | Zhang Mi Xu Jianjun Cheng Zunping Li Yinsheng and Zang Binyu | 2005 | Object-Oriented Real-Time Distributed Computing2005，，： | 1 |
| 3 | Characterizing and optimizing Java-based HPC applications on Intel many-core architecture显示文摘The increasing demand for performance has stimulated the wide adoption of many-core accelerators like IntelR Xeon PhiTMCoprocessor, which is based on Intel's Many Integrated Core architecture. While many HPC applications running in native mode have been tuned to run efficiently on Xeon Phi, it is still unclear how a managed runtime like JVM performs on such an architecture. In this paper, we present the first measurement study of a set of Java HPC applications on Xeon Phi under JVM. One key obstacle to the study is that there is currently little support of Java for Xeon Phi. This paper presents the result based on the first porting of Open JDK platform to Xeon Phi, in which the Hot Spot virtual machine acts as the kernel execution engine. The main difficulty includes the incompatibility between Xeon Phi ISA and the assembly library of Hotspot VM.By evaluating the multithreaded Java Grande benchmark suite and our ported Java Phoenix benchmarks, we quantitatively study the performance and scalability issues of JVM on Xeon Phi and draw several conclusions from the study. To fully utilize the vector computing capability and hide the significant memory access latency on the coprocessor, we present a semi-automatic vectorization scheme and software prefetching model in Hot Spot.Together with 60 physical cores and tuning, our optimized JVM achieves averagely 2.7 x and 3.5 x speedup compared to Xeon CPU processor by using vectorization and prefetching accordingly. Our study also indicates that it is viable and potentially performance-beneficial to run applications written for such a managed runtime like JVM on Xeon Phi. | Yang YU Tianyang LEI Haibo CHEN Binyu ZANG | 2017 | Science China(Information Sciences)2017，60，12： | 0 |
您所在的机构暂未开通此部分的功能，请联系管理员