Context. The paradigm of virtualization is rapidly changing due to hardware optimization and capabilities, while also due to rapid development and deployment strategies used in the modern day IT industry. Just like the positive changes, negative effects are necessary to occur in order to improve modern day technologies.This final year project takes a look at both the positive and negatives by exploring how containers are relevant to modern day computing and how they are affected by the patch that mitigates the Meltdown CPU vulnerabilities discovered in mid-2017 in terms of performance. Looking at the trade-off between information security and performance by taking an in-depth approach with a take on the core functionalities of the Linux Kernel. This paper succeeded to identify system call costs that between a secure and non-secure Linux kernel in the context of a containerized environment. Objectives. This study examines the effects of the KAISER security patch aimed to mitigate microprocessor vulnerabilities related to Meltdown. The investigated effect is the performance as the cost of system calls under the condition of a non-KAISER and a KAISER enabled Linux kernel. The intent is to increase the transparency of how a major security patch such as KAISER affects the system. Methods. A quantitative experimental study is conducted. One single Debian Stretch node is used with two different treatments. First micro-benchmarks are run without a KAISER enabled kernel which later is compared with a KAISER enabled kernel. The measuring point is the time one single system call takes in a sequence of 1 000 000 system calls. Results. First macro-benchmarks were conducted to see what a performance loss would look like on an application level. This proved to introduce many superfluous factors which made it difficult to use system calls as a measuring point. In the end a comparison between the two kernels was done. This indicated that the cost per system differed roughly 29% in time. Conclusions. The results indicate that a large performance loss is identified. However, this does not indicate that all activities on a computer will suffer from this loss. The performance loss the end-user will experience all depends on the amount of system calls generated from one single set of instructions. The performance loss can be neglected if these instructions generating a low amount of system calls. These results should notbe used as evidence to favor performance over information security in real life applications and implementations but rather as a motivation to meet the two aspects. / Kontext. Användning kring virtualisering håller snabbt på att förändras tack vare bättre hårdvaruoptimeringar och förmågor. Samtidigt ändras många olika utplaceringstrategier av datorresurser iden moderna IT industrin. Likväl alla positiva förändringar så introduceras det även effekter med negativa följder. Det här är ett examensarbete som ämnar att utforska båda dessa positiva och negativa effekter. Genom att titta på hur den populära virtualiserings tekniken som består av containers påverkas av uppdateringen som ska lösa sårbarhter i moderna processorer som går under namnet Meltdown. Påverkningarna definieras i form av prestanda vilket tillåter en djupare inspektering av de fundementala funktioner av Linux kärnan, där systemanrop kan användas som mätningspunkt. Metoden samt resultat i det här examensarbetet har med framgång lyckats hitta en kostnads skillnad per systemanrop under förhållandetav en osäker samt en säker Linux kärnna i en miljö som består av containers. Mål. Examensarbetet tittar på effekterna av uppdateringen som ska åtgärda sårbarheterna i moderna mikroprocessorer relaterade till Meltdown. De investigerade effekterna är definierade som prestandan där kostanden av systemanrop används som mätningspunkt. Meningen med det här examensarbetet att öka transparansen av vad en stor säkerhetsuppdatering gör med ett modernt datorsystem. Metod. En kvantitativ experimental studie utförs där en Debian Stretch nod används för att observera två olika behandlingar. Till början så körs det ”mikrobenchmarks” under förhållandet av en osäker Linux kärna. Sedan så följs detta upp med en säker Linux kärna. Till slut jämförs de olika resultat med varandra för att identifera hur mycket ett system anrop kostar under en sekvens av 10’000’000 systemanrop. Resultat. Som pilot studie utfördes det en rad olika tester som använder många olika verktyg för att se om det går att identifiera en prestanda förlust på applikations nivå. Genom att utföra tester utav den karaktären blev det tydligt att överflödiga faktorer förhindrade ett utfall som ansågs vara tillräcklig. Till slut hittades rätt typ av verktyg för att få fram ett utfall som visade att en prestanda skillnad på ~29% existerade mellan en osäker samt en säker Linux kärna. Sammanfattning. Resultatet indikerar att en prestanda förlust existerar. Dock påverkas inte den generella prestandan nödvändigtvis. Prestanda förlusten en slutanvändare kommer att uppleva beror helt på av hur stort antal systemanrop som genereras under sekvensen av aktiviteten som utförs. Resultatet som redovisas i detta examensarbete bör inte användas som motivation att prioritera prestanda över informations säkerhet i produktions miljöer men hellre som en motivation att kunna bemöta båda aspekterna.

Coordenação de Aperfeiçoamento de Pessoal de Nível Superior / The administration of medication and nutrients via parenteral is very used nowadays. One of the risks of this procedure is the presence of contaminants, which depending on their nature may cause severe damage to the patients due to the direct way of the administration (in the circulatory stream). In this work we investigated the possibility of the containers to be sources of metals for solutions of parenteral nutrition. The investigated containers are made of different kinds of glass and plastic polymers, namely polypropylene, PVC and EVA. The system container/solution (amino acids, salts, glucose and lipids) individually stored, was submitted to the sterilization process and after that stored for a time period of approximately 10 months, since the shelf-life period of these formulations are generally 2 years. After the sterilization and at regular time intervals, aliquots of each solution were collected and their contents on Al, Pb, Cd, Fe, Cr, Mn, Ba, and Zn were measured by graphite furnace atomic absorption spectrometry. The containers were also analyzed for the determination of the amount of each metal they contained. These metals are either constituents of the container material, as Al in glasses, or impurities in the case of plastic polymers. All containers presented the metals investigated. The solutions, depending on their composition (species dissolved) were able to extract the metals either from the glass or the polymers. The highest extraction rates occurred in solutions of the amino acids cysteine and glutamic acid, and in solutions of NaHCO3. The metals released in higher concentration were Ba, Pb and Zn form plastic containers and Al, Pb and Zn form glass containers. A different behavior was observed among the plastic polymers, and the different kinds of glass. While EVA was the most inert polymer, the clear glass ampoule released the highest amount of metals into the solutions. Fifty commercial samples were analyzed as well, and the investigated metals were found in all of them. The commercial formulations presented the same tendency of the individual sample used in the study, either in relation to the behavior of the substance in solution or the container material. / Atualmente a administração parenteral, tanto de medicamentos quanto nutrientes, é uma prática muito difundida. Um dos riscos desta prática é a presença de contaminantes que, dependendo da sua natureza, podem acarretar graves danos aos pacientes devido à forma direta (na corrente circulatória) da administração. Neste trabalho, investigou-se a possibilidade das embalagens serem fontes de contaminação por metais de soluções utilizadas na nutrição parenteral. As embalagens investigadas incluíram vários tipos de vidro e polímeros plásticos mais comumente utilizados (polipropileno, polivinil cloreto (PVC) e etil vinil acetato(EVA)). As embalagens, nas quais foram armazenados individualmente os constituintes das soluções parenterais (aminoácidos, sais, glicose, vitaminas e lipídeos), foram submetidas ao processo de esterilização e de armazenagem a longo prazo, visto que a validade deste tipo de formulação é geralmente de 2 anos. Após a esterilização e em intervalos de tempo regulares, alíquotas das soluções foram retiradas e os teores em Al, Pb, Cd, Fe, Cr, Mn, Ba e Zn foram medidos por espectrometria de absorção atômica forno de grafite (GF AAS) e espectrometria de massa com plasma indutivamente acoplado (ICP-MS). As embalagens utilizadas foram também analisadas para determinar quanto dos metais em estudo elas apresentavam, seja como constituinte, como é o caso do Al no vidro, ou como impureza, no caso de todos os metais nos polímeros plásticos. Todas as embalagens continham os metais em estudo em maior ou menor concentração. As soluções, dependendo dos seus constituintes foram capazes de extrair os metais, tanto do vidro quanto do plástico. As maiores taxas de extração ocorreram com as soluções dos aminoácidos cisteína e acido glutâmico. Os metais extraídos em maiores quantidades foram Ba, Pb e Zn das embalagens plásticas e Al, Pb e Zn das embalagens de vidro. Observou-se diferente comportamento entre os diferentes polímeros e tipos de vidro. O EVA mostrou-se o polímero mais inerte, enquanto que as ampolas transparentes foram as que mais metais liberaram para as soluções. Foram analisadas, também, 50 amostras comerciais, as quais se mostraram contaminadas pelos metais em estudo. Observou-se nas soluções comerciais a mesma tendência das soluções individuais do estudo, tanto com relação ao comportamento da embalagem, quanto ao conteúdo (ação do componente sobre a embalagem) e os metais extraídos.

No description available.

Approved for public release, distribution is unlimited / The Defense Transportation System (DTS), led by the Military Traffic Management Command (MTMC), depends on the commercial maritime industry to provide movement of supplies and equipment around the world. The maritime shipping container is a critical asset in providing for this logistical support to the war fighter abroad. These 20- or 40-foot containers have become the backbone of the maritime industry, and will continue to proliferate as global commerce continues to expand. While the growth in the use of maritime shipping containers in the 21st century has accelerated the nation's economic trade substantially, it may also have become a significant problem. Containers are an indispensable but vulnerable link in the chain of global trade; approximately 90 percent of the world's cargo moves by container. Because of DoD's dependency on the maritime industry and these containers, it will and must continue to ride the wave of commercial practices, specifically in pursuit of better security throughout the maritime industry. In the wake of September 11, 2001, and with the new threats of WMD, the maritime shipping container may become a weapons delivery system. This thesis documented the need for security improvements for the maritime shipping container in protecting global commerce and DoD cargo shipments. Comprehensive reviews of government reports, books, articles, and Internet based materials, as well as interviews with MTMC personnel, have indicated that DoD is taking a series of measures to meet these challenges. DoD's Defense Transportation System and the commercial maritime industry will be challenged and tested by new policy requirements. MTMC has already adopted new business processes, cargo manifest requirements, and technological innovations that assure customers in-transit visibility and total asset visibility (ITV/TAV), including the Intelligent Road-Rail Information Server (IRRIS) system. / Lieutenant Commander, United States Navy

Submitted by Rodrigo Teixeira Bombig (rodrigotila@hotmail.com) on 2011-11-30T14:01:39Z No. of bitstreams: 1 Dissertação Definitiva Rodrigo T Bombig.pdf: 1036216 bytes, checksum: 8b43efab5a30904a349ec669b6069046 (MD5) / Approved for entry into archive by Gisele Isaura Hannickel (gisele.hannickel@fgv.br) on 2011-11-30T14:32:48Z (GMT) No. of bitstreams: 1 Dissertação Definitiva Rodrigo T Bombig.pdf: 1036216 bytes, checksum: 8b43efab5a30904a349ec669b6069046 (MD5) / Made available in DSpace on 2011-11-30T14:44:18Z (GMT). No. of bitstreams: 1 Dissertação Definitiva Rodrigo T Bombig.pdf: 1036216 bytes, checksum: 8b43efab5a30904a349ec669b6069046 (MD5) Previous issue date: 2011-11-04 / As exportações de açúcar cristal e refinado vêm passando por modificações em suas operações logísticas. Nos últimos anos, os embarques brasileiros têm migrado de navios convencionais com sacas soltas e capacidade média de 14 mil toneladas para embarques fracionados, em lotes de contêineres e médias ao redor de 600 toneladas cada. Essa mudança é capaz de aumentar substancialmente a quantidade de embarques e diferentes processos de exportação, trazendo impactos logísticos importantes para os agentes envolvidos na cadeia. O objetivo deste trabalho é, então, descrever os passos necessários para a exportação do açúcar (branco), de acordo com as duas modalidades de embarques mais utilizadas. Adicionalmente serão realizados o mapeamento e a comparação dos custos operacionais e de coordenação, em ambos os formatos: navios convencionais e contêineres. Com isso, este estudo pretende ilustrar diferentes arranjos logísticos, suas práticas, desafios e tendências, podendo auxiliar os tomadores de decisões na busca de maior competitividade brasileira diante do mercado internacional de açúcar branco. / The crystal and refined sugar exportation are changing related to their logistic operations. In the last years, Brazilian shipments have migrated from conventional break bulk vessels with an average capacity of 14.000 tons for partial shipments of containers with an average around 600 tons each. This change can increase the number of different shipments and export processes, bringing major logistic impacts to the chain players. The objective of this work is describing the necessary steps for exportation of white sugar, according to the two commonly used methods of shipments. Additionally, it will map and compare the costs, operational and for coordination, in both formats: conventional vessels and containers. Thus, this study aims to illustrate different logistical arrangements, practices, challenges and trends, in order to assist the decision makers searching for increasing Brazilian competitiveness on the international white sugar market.

Det här arbetet hade målet att undersöka vilken storlek förlusten av resurser som Hyper-V och Windows Server container introducerar när ett system delas upp med dessa. Genom att testa detta skulle man också kunna jämföra Microsofts implementering av containerbaserad virtualisering med Linux implementering och se om det finns några likheter. För att kunna jämföra med tidigare forskning fanns målet att försöka efterlikna metoden i tidigare forskning som gjort liknande tester i operativsystemet Linux med KVM och LXC så nära som möjligt. Resultaten visades sig till stor del överensstämma med resultaten på tester genomförda i Linux. Det vill säga att container-baserad virtualisering har överlag en mindre förlust av resurser än hypervisor-baserad virtualisering. Undantaget var dock nätverkstesterna där container-baserad virtualisering presterade sämst men även detta överensstämde med tidigare forskning. / This work had the goal of looking at the loss of resources that Hyper-V and Windows Server container introduce when a system is partitioned with these. By testing this, you could also compare Microsoft's implementation of container-based virtualization with Linux implementation and see if there are any similarities. To be able to compare with previous research, the goal was to try to mimic the method in previous research that made similar tests in the Linux operating system with KVM and LXC as close as possible. The results were largely consistent with the results of tests conducted in Linux. That is, container-based virtualization generally has a smaller loss of resources than hypervisor-based virtualization. The exception was, however, the network tests where container-based virtualization performed poorest, but this also was consistent with previous research.

Les applications modernes ont des tendances de diverger à la fois le profile I/O et les requiers du stockage. La liaison d'une application scientifique ou commerciale avec un system "general-purpose" produit probablement un résultât sous-optimale. Même sous la présence des systèmes "purpose specific" des application aux classes multiples de workloads ont encore besoin de distribuer du travail de calcul au correct system. Cependant, cette stratégie n'est pas triviale comme des plateformes différentes butent diversifier leur propos et par conséquence elles requièrent que l'application intégrée des chemins multiples de code. Le but de l'implémentation de ces chemins n'est pas trivial, il requiert beaucoup d'effort et des capacités de codage. Le problème devient vaste quand les applications ont besoin de bénéficier de plusieurs data-stores en parallèle. Dans cette dissertation, on va introduire les "storage containers" comme le prochain étape logique, mais révolutionnaire. Un "storage container" est une infrastructure virtuelle qui découple une application de ses data-stores correspondants avec la même manière que Docker découple l'application runtime des servers physiques. En particulier, un "storage container" est un middleware qui sépare des changements fait pour bouts de code des application par des utilisateurs scientifiques, de celui fait pour des actions de I/O par des développeurs ou des administrateurs.Pour faciliter le développement et déploiement d'un "storage container" on va introduire un cadre appelé Tromos. Parmi son filtre, tout qui est nécessaire pour qu'un architecte d'une application construite une solution de stockage est de modéliser l'environnement voulu dans un fichier de définition and laisser le reste au logiciel. Tromos est livré avec un dépôt de plugins parmi les quelles l'architecte peut choisir d'optimiser le conteneur pour l'application activée. Parmi des options disponibles, sont inclus des transformations des données, des politiques de placement des données, des méthodes de reconstruction des données, du management d'espace de noms, et de la gestion de la cohérence à la demande. Comme preuve de concept, on utilisera Tromos pour créer des environnements de stockage personnalisés facilement comparés à Gluster, un système de stockage bien établi et polyvalent. Les résultats vous montrent que les "storage containers" adaptés aux applications, même s'ils sont auto-produits, peuvent surpasser les systèmes "general purpose" les plus sophistiqués en supprimant simplement la surcharge inutile de fonctionnalités factices. / Modern applications tend to diverge both in the I/O profile and storage requirements. Matching a scientific or commercial application with a general-purpose system will most likely yield suboptimal performance. Even in the presence of purpose-specific' systems, applications with multiple classes of workloads are still in need to disseminate the workload to the right system. This strategy, however, is not trivial as different platforms aim at diversified goals and therefore require the application to incorporate multiple codepaths. Implementing such codepaths is non-trivial, requires a lot of effort and programming skills, and is error-prone. The hurdles are getting worse when applications need to leverage multiple data-stores in parallel. In this dissertation, we introduce "storage containers" as the next logical in the storage evolution. A "storage container" is virtual infrastructure that decouples the application from the underlying data-stores in the same way Docker decouples the application runtime from the physical servers. In other words, it is middleware that separate changes made to application codes by science users from changes made to I/O actions by developers or administrators.To facilitate the development and deployment of a "storage container" we introduce a framework called Tromos. Through its lens, all that it takes for an application architect to spin-up a custom storage solution is to model the target environment into a definition file and let the framework handles the rest. Tromos comes with a repository of plugins which the architect can choose as to optimize the container for the application at hand. Available options include data transformations, data placement policies, data reconstruction methods, namespace management, and on-demand consistency handling.As a proof-of-concept we use Tromos to prototype customized storage environments which we compare against Gluster; a well-estalished and versatile storage system. The results have shown that application-tailored "storage containers", even if they are auto-produced, can outperform more mature "general-purpose" systems by merely removing the unnecessary overhead of unused features.

Through the development and design of a Mobile Exhibition System (MES) in this thesis, I will demonstrate the benefits and possibilities of a flexible and mobile system within an exhibition environment. A flexible system will be able to adapt to a wide range of content, while at the same time, maintaining a synergy between its form and function. By the reuse and reappropriation of shipping containers as the exhibition envelope, the goal of mobility can be achieved, reaching out to those who might not otherwise experience learning through an exhibition environment.

O Plano Nacional de Logística e Transportes (PNLT) sinalizou a intenção de uma mudança substancial na matriz de transporte de cargas brasileira, com a diminuição do modal rodoviário e uma transição do modal aquaviário de 13 para 29% até 2025, o que só será possível com a ampliação da cabotagem. Desta forma, o presente trabalho dimensiona terminais \"rápidos\" de contêineres dedicados à cabotagem, que a partir de sua implantação possam ser ampliados gradativamente. Por meio de simulação de eventos discretos, o melhor layout modular, dimensionado por berço, foi definido de acordo com a demanda de contêineres movimentados e equipamentos utilizados, de forma a identificar gargalos e obter a melhor opção de modularização. Tal abordagem de terminais \"rápidos\" dedicados permitiria a desburocratização do sistema atual e a redução dos custos e tempos de armazenamento, tornando a cabotagem mais competitiva. / The National Logistics and Transport Plan (PNLT) has the intention of a substantial change in the Brazilian cargo transportation matrix, with the reduction of the road modal and a transition from 13 to 29% in the waterway modal by 2025, which will only be possible with the increase of short sea shipping. Thus, the present work will size a modular \"fast\" containers terminal dedicated to short sea shipping, that when implemented could be gradually extended. Using discrete events simulation, the best modular layout, dimensioned by berths, was defined according to containers demand and chosen equipments, in order to identify bottlenecks and the best modularization option. Such an approach of dedicated \"fast\" terminals would allow the reduction of bureaucratization of the current system and transport and storage costs and times, making short sea shipping more competitive.

Dans cette thèse, nous proposons une amélioration de l'automatisation des preuves dans l'assistant de preuve Coq. Cette automatisation est obtenue en intégrant à Coq les procédures de décision pour la logique propositionnelle, l'égalité et l'arithmétique linéaire constituant le noyau du solveur SMT Alt-Ergo. Cette intégration est réalisée en utilisant la technique de preuve par réflexion, qui consiste à développer en Coq ces algorithmes et à prouver formellement leur correction de manière à les exécuter directement dans l'assistant de preuve. Comme les algorithmes formalisés en Coq sont exactement ceux utilisés dans le noyau d'Alt-Ergo, notre travail permet également d'augmenter considérablement la confiance que l'on peut avoir dans ce dernier. En particulier, il utilise un algorithme original de combinaison de l'égalité modulo une théorie, inspiré de la combinaison de Shostak et appelé CC(X), et dont la justification est relativement complexe.Notre développement Coq est utilisable sous la forme de tactiques qui permettent de valider automatiquement des formules combinant logique propositionnelle, égalité et arithmétique. Afin que ces tactiques soient le plus efficaces possibles, nous avons attaché une grande importance aux performances de notre implantation Coq, et en particulier à l'utilisation de structures de données efficaces courantes, dont nous proposons ici une bibliothèque. / In this thesis, we propose new automation capabilities for the Coq proof assistant. We obtain this mechanization via an integration into Coq of decision procedures for propositional logic, equality reasoning and linear arithmetic which make up the core of the Alt-Ergo SMT solver. This integration is achieved through the reflection technique, which consists in implementing and formally proving these algorithms in Coq in order to execute them directly in the proof assistant. Because the algorithms formalized in Coq are exactly those in use in Alt-Ergo's kernel, this work significantly increases our trust in the solver. In particular, it embeds an original algorithm for combining equality modulo theory reasoning, called CC(X) and inspired by the Shostak combination algorithm, and whose justification is quite complex. Our Coq implementation is available in the form of tactics which allow one to automatically solve formulae combining propositional logic, equality and arithmetic. In order to make these tactics as efficient as may be, we have taken special care with performance in our implementation, in particular through the use of classical efficient data structures, which we provide as a separate library.