Zugl.: Paderborn, Univ., Diss., 2010

Since the first CubeSat launch in 2003, the hardware and software complexity of the nanosatellites was continuosly increasing. To keep up with the continuously increasing mission complexity and to retain the primary advantages of a CubeSat mission, a new approach for the overall space and ground software architecture and protocol configuration is elaborated in this work. The aim of this thesis is to propose a uniform software and protocol architecture as a basis for software development, test, simulation and operation of multiple pico-/nanosatellites based on ultra-low power components. In contrast to single-CubeSat missions, current and upcoming nanosatellite formation missions require faster and more straightforward development, pre-flight testing and calibration procedures as well as simultaneous operation of multiple satellites. A dynamic and decentral Compass mission network was established in multiple active CubeSat missions, consisting of uniformly accessible nodes. Compass middleware was elaborated to unify the communication and functional interfaces between all involved mission-related software and hardware components. All systems can access each other via dynamic routes to perform service-based M2M communication. With the proposed model-based communication approach, all states, abilities and functionalities of a system are accessed in a uniform way. The Tiny scripting language was designed to allow dynamic code execution on ultra-low power components as a basis for constraint-based in-orbit scheduler and experiment execution. The implemented Compass Operations front-end enables far-reaching monitoring and control capabilities of all ground and space systems. Its integrated constraint-based operations task scheduler allows the recording of complex satellite operations, which are conducted automatically during the overpasses. The outcome of this thesis became an enabling technology for UWE-3, UWE-4 and NetSat CubeSat missions. / Seit dem Launch des ersten CubeSats im Jahr 2003, hat die Komplexität der Nanosatelliten stetig zugenommen. Um mit den wachsenden Anforderungen Schritt zu halten und gleichzeitig nicht auf die Hauptvorteile einer CubeSat Mission zu verzichten, wird eine einheitliche Protokoll- und Softwarearchitektur für den gesamten Weltraum- und Bodensegment vorgeschlagen. Diese Arbeit schlägt eine einheitliche Software- und Protokoll-Architektur vor als Basis für Softwareentwicklung, Tests und Betrieb von mehreren Pico-/Nanosatelliten. Im Gegensatz zu Missionen mit nur einem CubeSat, erfordern künftige Nanosatelliten-Formationen eine schnellere und einfachere Entwicklung, Vorflug-Tests, Kalibrierungsvorgänge sowie die Möglichkeit mehrere Satelliten gleichzeitig zu betreiben. Ein dynamisches und dezentrales Compass Missionsnetzwerk wurde in mehreren CubeSat-Missionen realisiert, bestehend aus einheitlich zugänglichen Knoten. Die Compass-Middleware wurde entwickelt, um sowohl die Kommunikation als auch funktionale Schnittstellen zwischen allen beteiligten Software und Hardware Systemen in einer Mission zu vereinheitlichen: Rechner des Bedienpersonals, Bodenstationen, Mission-Server, Testeinrichtungen, Simulationen und Subsysteme aller Satelliten. Mit dem Ansatz der modellbasierten Kommunikation wird auf alle Zustände und Funktionen eines Systems einheitlich zugegriffen. Die entwickelte Tiny Skriptsprache ermöglicht die Ausführung von dynamischem Code auf energiesparenden Systemen, um so in-orbit Scheduler zu realisieren. Das Compass Operations Front-End bietet zahlreiche grafische Komponenten, mit denen alle Weltraum- und Bodensegment-Systeme einheitlich überwacht, kontrolliert und bedient werden. Der integrierte Betrieb-Scheduler ermöglicht die Aufzeichnung von komplexen Satellitenbetrieb-Aufgaben, die beim Überflug automatisch ausgeführt werden. Die Ergebnisse dieser Arbeit wurden zur Enabling-Technologie für UWE-3, UWE-4 und NetSat Missionen.

Workshop "Netz- und Service-Infrastrukturen" Skalierbare Verfahren zur Systemadministration von Rechnersystemen

Chemnitz, Techn. Univ., Studienarb., 2002.

Cyber-physikalische Systeme (CPS) sind eine erweitere Sicht auf eingebettete Systeme, die die konkreten umgebenden Elemente in das Systemdesign einbeziehen. Das Design solcher Systeme erfordert neue Herangehensweisen: Während beispielsweise in "normalen" verteilten Systemen Aspekte wie "Bewegung" oder "Ort" möglichst transparent und damit für den Nutzer unsichtbar gestaltet werden, benötigen CPS-Anwendungen häufig Bewusstsein für Bewegung oder Ort, d.h., sie sind _motion aware_ oder _location aware_. Die Professur "Betriebssysteme" der TUC hat sich die Frage gestellt, wie eine generische Unterstützung für solche verteilte mobile Systeme aussehen könnte. Im Vortrag werden Probleme, Konzepte und erste Lösungsansätze für ein künftiges Betriebssystem für diese Art von Systemen vorgestellt.

Verstärkt werden in öffentlichen und kommerziellen Einrichtungen elektronische Zugangssteuerungen eingesetzt, da diese flexibler und pro Nutzer preiswerter sind als herkömmliche Schließsysteme. Für diesen Zweck bieten verschiedene Hersteller Komplettlösungen an, welche aber meist nicht alle Anforderungen abdecken, schlecht in vorhandene Strukturen integrierbar, nur mit Aufwand erweiterbar, herstellergebunden und vor allem teuer sind. Wünschenswert sind hier aber offene, herstellerunabhängige und integrierbare verteilte Systeme zur Zugangssteuerung.

It is a great research interest to integrate the Cell/B.E. processor into an AMD Opteron system. The result is a system benefiting from the advantages of both processors: the high computational power of the Cell/B.E. and the high I/O throughput of the Opteron. The task of this diploma thesis is to accomplish, that Cell-SPU code initially residing on the Opteron could be executed on the Cell under the GNU/Linux operating system. However, the SPUFS (Synergistic Processing Unit File System), provided from STI (Sony, Toshiba, IBM), does exactly the same thing on the Cell. The Cell is a combination of a PowerPC core and Synergistic Processing elements (SPE). The main work is to analyze the SPUFS and migrate it to the Opteron System. The result of the migration is a project called RSPUFS (Remote Synergistic Processing Unit File System), which provides nearly the same interface as SPUFS on the Cell side. The differences are caused by the TCP/IP link between Opteron and Cell, where no Remote Direct Memory Access (RDMA) is available. So it is not possible to write synchronously to the local store of the SPEs. The synchronization occurs implicitly before executing the Cell-SPU code. But not only semantics have changed: to access the XDR memory RSPUFS extends SPUFS with a special XDR interface, where the application can map the XDR into the local address space. The application must be aware of synchronization with an explicit call of the provided ''xdr\_sync'' routine. Another difference is, that RSPUFS does not support the gang principle of SPUFS, which is necessary to set the affinity between the SPEs. This thesis deals not only with the operating system part, but also with a library called ''libspe''. Libspe provides a wrapper around the SPUFS system calls. It is essential to port this library to the Opteron, because most of the Cell applications use it. Libspe is not only a wrapper, it saves a lot of work for the developer as well, like loading the Cell-SPU code or managing the context and system calls initiated by the SPE. Thus it has to be ported, too. The result of the work is, that an application can link against the modified libspe on the Opteron gaining direct access to the Synergistic Processor Elements.

Although modern computer systems process increasing amounts of sensitive, private, and valuable information, most of today’s operating systems (OSs) fail to protect confidential data against unauthorized disclosure over covert channels. Securing the large code bases of these OSs and checking the secured code for the absence of covert channels would come at enormous costs. Microkernels significantly reduce the necessarily trusted code. However, cost-efficient, provable confidential-data protection in microkernel-based systems is still challenging. This thesis makes two central contributions to the provable protection of confidential data against disclosure over covert channels: • A budget-enforcing, fixed-priority scheduler that provably eliminates covert timing channels in open microkernel-based systems; and • A sound control-flow-sensitive security type system for low-level operating-system code. To prevent scheduling-related timing channels, the proposed scheduler treats possibly leaking, blocked threads as if they were runnable. When it selects such a thread, it runs a higher classified budget consumer. A characterization of budget-consumer time as a blocking term makes it possible to reuse a large class of existing admission tests to determine whether the proposed scheduler can meet the real-time guarantees of all threads we envisage to run. Compared to contemporary information-flow-secure schedulers, significantly more real-time threads can be admitted for the proposed scheduler. The role of the proposed security type system is to prove those system components free of security policy violating information flows that simultaneously operate on behalf of differently classified clients. In an open microkernel-based system, these are the microkernel and the necessarily trusted multilevel servers. To reduce the complexity of the security type system, C++ operating-system code is translated into a corresponding Toy program, which in turn is complemented with calls to Toy procedures describing the side effects of interactions with the underlying hardware. Toy is a non-deterministic intermediate programming language, which I have designed specifically for this purpose. A universal lattice for shared-memory programs enables the type system to check the resulting Toy code for potentially harmful information flows, even if the security policy of the system is not known at the time of the analysis. I demonstrate the feasibility of the proposed analysis in three case studies: a virtual-memory access, L4 inter-process communication and a secure buffer cache. In addition, I prove Osvik’s countermeasure effective against AES cache side-channel attacks. To my best knowledge, this is the first security-type-system-based proof of such a countermeasure. The ability of a security type system to tolerate temporary breaches of confidentiality in lock-protected shared-memory regions turned out to be fundamental for this proof.

Failing hardware is a fact and trends in microprocessor design indicate that the fraction of hardware suffering from permanent and transient faults will continue to increase in future chip generations. Researchers proposed various solutions to this issue with different downsides: Specialized hardware components make hardware more expensive in production and consume additional energy at runtime. Fault-tolerant algorithms and libraries enforce specific programming models on the developer. Compiler-based fault tolerance requires the source code for all applications to be available for recompilation. In this thesis I present ASTEROID, an operating system architecture that integrates applications with different reliability needs. ASTEROID is built on top of the L4/Fiasco.OC microkernel and extends the system with Romain, an operating system service that transparently replicates user applications. Romain supports single- and multi-threaded applications without requiring access to the application's source code. Romain replicates applications and their resources completely and thereby does not rely on hardware extensions, such as ECC-protected memory. In my thesis I describe how to efficiently implement replication as a form of redundant multithreading in software. I develop mechanisms to manage replica resources and to make multi-threaded programs behave deterministically for replication. I furthermore present an approach to handle applications that use shared-memory channels with other programs. My evaluation shows that Romain provides 100% error detection and more than 99.6% error correction for single-bit flips in memory and general-purpose registers. At the same time, Romain's execution time overhead is below 14% for single-threaded applications running in triple-modular redundant mode. The last part of my thesis acknowledges that software-implemented fault tolerance methods often rely on the correct functioning of a certain set of hardware and software components, the Reliable Computing Base (RCB). I introduce the concept of the RCB and discuss what constitutes the RCB of the ASTEROID system and other fault tolerance mechanisms. Thereafter I show three case studies that evaluate approaches to protecting RCB components and thereby aim to achieve a software stack that is fully protected against hardware errors.

Zugl.: Hohenheim, University, Diss., 2008.