The past decade has witnessed the rapid growth of data in large-scale distributed storage systems. Triplication, a reliability mechanism with 3x storage overhead and adopted by large-scale distributed storage systems, introduces heavy storage cost as data amount in storage systems keep growing. Consequently, erasure codes have been introduced in many storage systems because they can provide a higher storage efficiency and fault tolerance than data replication. However, erasure coding has many performance degradation factors in both I/O and computation operations, resulting in great performance degradation in large-scale erasure-coded storage systems. In this thesis, we investigate how to eliminate some key performance issues in I/O and computation operations for applying erasure coding in large-scale storage systems. We also propose a prototype named ESetStore to improve the recovery performance of erasure-coded storage systems. We introduce our studies as follows. First, we study the encoding and decoding performance of the erasure coding, which can be a key bottleneck with the state-of-the-art disk I/O throughput and network bandwidth. We propose a graphics processing unit (GPU)-based implementation of erasure coding named G-CRS, which employs the Cauchy Reed-Solomon (CRS) code, to improve the encoding and decoding performance. To maximize the coding performance of G-CRS by fully utilizing the GPU computational power, we designed and implemented a set of optimization strategies. Our evaluation results demonstrated that G-CRS is 10 times faster than most of the other coding libraries. Second, we investigate the performance degradation introduced by intensive I/O operations in recovery for large-scale erasure-coded storage systems. To improve the recovery performance, we propose a data placement algorithm named ESet. We define a configurable parameter named overlapping factor for system administrators to easily achieve desirable recovery I/O parallelism. Our simulation results show that ESet can significantly improve the data recovery performance without violating the reliability requirement by distributing data and code blocks across different failure domains. Third, we take a look at the performance of applying coding techniques to in-memory storage. A reliable in-memory cache for key-value stores named R-Memcached is designed and proposed. This work can be served as a prelude of applying erasure coding to in-memory metadata storage. R-Memcached exploits coding techniques to achieve reliability, and can tolerate up to two node failures. Our experimental results show that R-Memcached can maintain very good latency and throughput performance even during the period of node failures. At last, we design and implement a prototype named ESetStore for erasure-coded storage systems. The ESetStore integrates our data placement algorithm ESet to bring fast data recovery for storage systems.

Biometric systems are being increasingly used, from daily entertainment to critical applications such as security access and identity management. It is known that biometric systems should meet the stringent requirement of low error rate. In addition, for critical applications, the security and privacy issues of biometric systems are required to be concerned. Otherwise, severe consequence such as the unauthorized access (security) or the exposure of identity-related information (privacy) can be caused. Therefore, it is imperative to study the vulnerability to potential attacks and identify the corresponding risks. Furthermore, the countermeasures should also be devised and patched on the systems. In this thesis, we study the security and privacy issues in biometric systems. We first make an attempt to reconstruct raw biometric data from biometric templates and demonstrate the security and privacy issues caused by the data reconstruction. Then, we make two attempts to protect biometric templates from being reconstructed and improve the state-of-the-art biometric template protection techniques.

La demande croissante de toujours plus de débit pour les télécommunications entraine une augmentation de la fréquence de fonctionnement des liaisons séries. Cette demande se retrouve aussi dans les systèmes embarqués du fait de l'augmentation des performances des composants et périphériques. Afin de s'assurer que le train de données est bien réceptionné, un circuit de restitution d'horloge et de données est placé avant tout traitement du coté du récepteur. Dans ce contexte, les activités de recherche présentées dans cette thèse se concentrent sur la conception d'une CDR (Clock and Data Recovery). Nous détaillerons le comparateur de phase qui joue un rôle critique dans un tel système. Cette thèse présente un comparateur de phase ayant comme avantage d'avoir une mode de fenêtrage et une fréquence de fonctionnement réduite. La topologie spéciale utilisée pour la CDR est décrite, et la théorie relative aux oscillateurs verrouillés en injection est expliquée. L'essentiel du travail de recherche s'est concentrée sur la conception et le layout d'une restitution d'horloge dans le domaine millimétrique, à 80 Gbps. Pour cela plusieurs prototypes ont été réalisés en technologie BiCMOS 130 nm de STMicrolectronics. / The increasing bandwidth demand for telecommunication leads to an important rise of serial link operating frequencies. This demand is also present in embedded systems with the growth of devices and peripherals performances. To ensure the data stream is well recovered, a clock and data recovery (CDR) circuit is placed before any logical blocks on the receiver side. The research activities presented in this thesis are related to the design of such a CDR. The phase detector plays a critical role in the CDR circuit and is specially studied. This thesis presents a phase comparator that provides an enhancement by introducing a windowed mode and reducing its operating frequency. The used CDR has a special topology, which is described, and the injection locked oscillator theory is explained. Most of the research of this study has focused on the design and layout of a 80 Gbps CDR. Several prototypes are realized in 130 nm SiGe process from STMicroelectronics.

Distribution of video contents over the Internet has increased drastically over the past few years. With technological advancements and emergence of social media services, video content sharing has grown exponentially. An increased number of cyber crimes today belong to possession or distribution of illegal video contents over the Internet. Therefore, it is crucial for forensic examiners to have the capability of recovering and analyzing illegal video contents from seized storage devices. File carving is an advanced forensic technique used to recover deleted contents from a storage device even when there is no file system present. After recovering a deleted video file, its contents have to be analyzed manually in order to classify them. This is not only very stressful but also takes a large amount of time. In this thesis we propose a carving approach for streaming multimedia formats that allows forensic examiners to recover individual frames of a video file as images. The contents of these images then can be classified using existing techniques for forensic analysis of image sets. A carving tool based on this approach is developed for MPEG-1 video files. A number of experiments are conducted to evaluate performance of the tool. For each experiment an MPEG-1 file with different encoding parameters is used. Moreover, each experiment contains 18 runs and with each run chunk size of the input MPEG-1 file is varied in order to create different amount of disk fragmentation For video only MPEG-1 files, 87.802 % frames are fully recovered when the chunk size is equal to 124 KB. Where as in the case of MPEG-1 files containing both audio and video data 90.55 % frames are fully recovered when the chunk size is 132 KB.

Non-profit organizations are faced with unique personnel and resource limitations. When their network systems are compromised, these organizations are faced with determining whether or not to invest the time and effort into a forensic investigation. With specific consideration given to the unique concerns of these non-profit organizations, the goal of this work is to define how the administrators of non-profit organizations can conduct forensic investigations. To advance this goal, a case study was created to highlight the tools and methodologies available to cost-conscious organizations. Of a major concern to these organizations is the learning curve required to properly implement an investigation; this work not only details which tools are suggested for use, but also describes how to use them. In the final evaluation, organizations balance the cost in manpower and resources against the benefits of prosecution and education.

As a result of our heavy reliance on internet usage and running online transactions, authentication has become a routine part of our daily lives. So, what happens when we lose or cannot use our digital credentials? Can we securely recover our accounts? How do we ensure it is the genuine user that is attempting a recovery while at the same time not introducing too much friction for the user? In this dissertation, we present research results demonstrating that account recovery is a growing need for users as they increase their online activity and use different authentication factors. We highlight that the account recovery process is the weakest link in the authentication domain because it is vulnerable to account takeover attacks because of the less secure fallback authentication mechanisms usually used. To close this gap, we study user behavior-based machine learning (ML) modeling as a critical part of the account recovery process. The primary threat model for ML implementation in the context of authentication is poisoning and evasion attacks. Towards that end, we research randomized modeling techniques and present the most effective randomization strategy in the context of user behavioral biometrics modeling for account recovery authentication. We found that a randomization strategy that exclusively relied on the user’s data, such as stochastically varying the features used to generate an ensemble of models, outperformed a design that incorporated external data, such as adding gaussian noise to outputs. This dissertation asserts that account recovery process security posture can be vastly improved by incorporating user behavior modeling to add resiliency against account takeover attacks and nudging users towards voluntary adoption of more robust authentication factors.

Recent years have witnessed an increasing demand for super data clusters. The super data clusters have reached the petabyte-scale can consist of thousands or tens of thousands storage nodes at a single site. For this architecture, reliability is becoming a great concern. In order to achieve a high reliability, data recovery and node reconstruction is a must. Although extensive research works have investigated how to sustain high performance and high reliability in case of node failures at large scale, a reverse lookup problem, namely finding the objects list for the failed node remains open. This is especially true for storage systems with high requirement of data integrity and availability, such as scientific research data clusters and etc. Existing solutions are either time consuming or expensive. Meanwhile, replication based block placement can be used to realize fast reverse lookup. However, they are designed for centralized, small-scale storage architectures. In this thesis, we propose a fast and efficient reverse lookup scheme named Group-based Shifted Declustering (G-SD) layout that is able to locate the whole content of the failed node. G-SD extends our previous shifted declustering layout and applies to large-scale file systems. Our mathematical proofs and real-life experiments show that G-SD is a scalable reverse lookup scheme that is up to one order of magnitude faster than existing schemes.

Circuits to extend operation data-rate of a optical receiver is investigated in the dissertation. A new input-stage topology for a transimpedance amplifier (TIA) is designed to achieve 50% higher data-rate is presented, and a new architecture for clock recovery is proposed for 50% higher clock rate. The TIA is based on a gm-boosted common-gate amplifier. The input-resistance is reduced by modifying a transistor at input stage to be diode-connected, and therefore lowers R-C time constant at the input and yielding higher input pole frequency. It also allows removal of input inductor, which reduces design complexity. The proposed circuit was designed and fabricated in 32 nm CMOS SOI technology. Compared to TIAs which mostly operates at 50 GHz bandwidth or lower, the presented TIA stage achieves bandwidth of 74 GHz and gain of 37 dBohms while dissipating 16.5 mW under 1.5V supply voltage. For the clock recovery circuit, a phase-locked loop is designed consisting of a frequency doubling mechanism, a mixer-based phase detector and a 40 GHz voltage-controlled oscillator. The proposed frequency doubling mechanism is an all-analog architecture instead of the conventional digital XOR gate approach. This approach realizes clock-rate of 40 GHz, which is at least 50% higher than other circuits with mixer-based phase detector. Implemented with 0.13-μm CMOS technology, the clock recovery circuit presents peak-to-peak clock jitter of 2.38 ps while consuming 112 mW from a 1.8 V supply. / Ph. D. / This dissertation presents two electronic circuits for future high-speed fiber optics applications. A receiver in a optical communication systems includes several circuit blocks serving various functions: (1) a photodiode for detecting the input signal; (2) a transimpedance amplifier (TIA) to amplify the input signal; (3) a clock and data recovery block to re-condition the input signal; and (4) digital signal processing. High speed integrated circuits are commonly fabricated in SiGe or other high electron mobility semiconductor technologies, but receiver circuits based on Silicon using complementary metal oxide semiconductor (CMOS) technology has gained attention in open literatures due to its advantage of integrating signal processing . This dissertation shows a TIA circuit and a clock recovery circuit designed and implemented in CMOS technology. The TIA circuit is based on a ”g_m-boosted common-gate amplifier” topology, and a slight modification at the input of the topology is proposed. Implemented in 32nm SOI CMOS technology, the TIA measures bandwidth that achieved 100 Gb/s bandwidth. The bandwidth is increased by at least 48% when compared with state-of-the-art CMOS TIA’s. The clock recovery circuit is a phase-locked loop with a mixer as the phase detector. An architectural change of replacing the conventional frequency doubling mechanism is proposed. The circuit is implemented in 0.13 µm CMOS technology, and it achieved 40 GHz clock rate with 40 Gb/s data input, which is about 40% increase of clock rate compared to state-of-the-art clock recovery circuits of similar architecture.

雲存儲是一個新興的服務模式，讓個人和企業的數據備份外包予較低成本的遠程雲服務提供商。本論文提出的方法，以確保數據的安全性和雲備份系統的可靠性。 / 在本論文的第一部分，我們提出 FadeVersion，安全的雲備份作為今天的雲存儲服務上的安全層服務的系統。 FadeVersion實現標準的版本控制備份設計，從而消除跨不同版本備份的冗餘數據存儲。此外，FadeVersion在此設計上加入了加密技術以保護備份。具體來說，它實現細粒度安全删除，那就是，雲客戶可以穩妥地在雲上删除特定的備份版本或文件，使有關文件永久無法被解讀，而其它共用被删除數據的備份版本或文件將不受影響。我們實現了試驗性原型的 FadeVersion並在亞馬遜S3之上進行實證評價。我們證明了，相對於不支援度安全删除技術傳統的雲備份服務 FadeVersion只增加小量額外開鎖。 / 在本論文的第二部分，提出 CFTDedup一個分佈式代理系統，利用通過重複數據删除增加雲存儲的效率，而同時確保代理之間的崩潰容錯。代理之間會進行同步以保持重複數據删除元數據的一致性。另外，它也分批更新元數據減輕同步帶來的開銷。我們實現了初步的原型CFTDedup並通過試驗台試驗，以存儲虛擬機映像評估其重複數據删除的運行性能。我們還討論了幾個開放問題，例如如何提供可靠、高性能的重複數據删除的存儲。我們的CFTDedup原型提供了一個平台來探討這些問題。 / Cloud storage is an emerging service model that enables individuals and enterprises to outsource the storage of data backups to remote cloud providers at a low cost. This thesis presents methods to ensure the data security and reliability of cloud backup systems. / In the first part of this thesis, we present FadeVersion, a secure cloud backup system that serves as a security layer on top of todays cloud storage services. FadeVersion follows the standard version-controlled backup design, which eliminates the storage of redundant data across different versions of backups. On top of this, FadeVersion applies cryptographic protection to data backups. Specifically, it enables ne-grained assured deletion, that is, cloud clients can assuredly delete particular backup versions or files on the cloud and make them permanently in accessible to anyone, while other versions that share the common data of the deleted versions or les will remain unaffected. We implement a proof-of-concept prototype of FadeVersion and conduct empirical evaluation atop Amazon S3. We show that FadeVersion only adds minimal performance overhead over a traditional cloud backup service that does not support assured deletion. / In the second part of this thesis, we present CFTDedup, a distributed proxy system designed for providing storage efficiency via deduplication in cloud storage, while ensuring crash fault tolerance among proxies. It synchronizes deduplication metadata among proxies to provide strong consistency. It also batches metadata updates to mitigate synchronization overhead. We implement a preliminary prototype of CFTDedup and evaluate via test bed experiments its runtime performance in deduplication storage for virtual machine images. We also discuss several open issues on how to provide reliable, high-performance deduplication storage. Our CFTDedup prototype provides a platform to explore such issues. / Detailed summary in vernacular field only. / Detailed summary in vernacular field only. / Detailed summary in vernacular field only. / Rahumed, Arthur. / Thesis (M.Phil.)--Chinese University of Hong Kong, 2012. / Includes bibliographical references (leaves 47-51). / Abstracts also in Chinese. / Chapter 1 --- Introduction --- p.1 / Chapter 1.1 --- Cloud Based Backup and Assured Deletion --- p.1 / Chapter 1.2 --- Crash Fault Tolerance for Backup Systems with Deduplication --- p.4 / Chapter 1.3 --- Outline of Thesis --- p.6 / Chapter 2 --- Background and Related Work --- p.7 / Chapter 2.1 --- Deduplication --- p.7 / Chapter 2.2 --- Assured Deletion --- p.7 / Chapter 2.3 --- Policy Based Assured Deletion --- p.8 / Chapter 2.4 --- Convergent Encryption --- p.9 / Chapter 2.5 --- Cloud Based Backup Systems --- p.10 / Chapter 2.6 --- Fault Tolerant Deduplication Systems --- p.10 / Chapter 3 --- Design of FadeVersion --- p.12 / Chapter 3.1 --- Threat Model and Assumptions for Fade Version --- p.12 / Chapter 3.2 --- Motivation --- p.13 / Chapter 3.3 --- Main Idea --- p.14 / Chapter 3.4 --- Version Control --- p.14 / Chapter 3.5 --- Assured Deletion --- p.16 / Chapter 3.6 --- Assured Deletion for Multiple Policies --- p.18 / Chapter 3.7 --- Key Management --- p.19 / Chapter 4 --- Implementation of FadeVersion --- p.20 / Chapter 4.1 --- System Entities --- p.20 / Chapter 4.2 --- Metadata Format in FadeVersion --- p.22 / Chapter 5 --- Evaluation of FadeVersion --- p.24 / Chapter 5.1 --- Setup --- p.24 / Chapter 5.2 --- Backup/Restore Time --- p.26 / Chapter 5.3 --- Storage Space --- p.28 / Chapter 5.4 --- Monetary Cost --- p.29 / Chapter 5.5 --- Conclusions --- p.30 / Chapter 6 --- CFTDedup Design --- p.31 / Chapter 6.1 --- Failure Model --- p.31 / Chapter 6.2 --- System Overview --- p.32 / Chapter 6.3 --- Distributed Deduplication --- p.33 / Chapter 6.4 --- Crash Fault Tolerance --- p.35 / Chapter 6.5 --- Implementation --- p.36 / Chapter 7 --- Evaluation of CFTDedup --- p.37 / Chapter 7.1 --- Setup --- p.37 / Chapter 7.2 --- Experiment 1 (Archival) --- p.38 / Chapter 7.3 --- Experiment 2 (Restore) --- p.39 / Chapter 7.4 --- Experiment 3 (Recovery) --- p.40 / Chapter 7.5 --- Summary --- p.41 / Chapter 8 --- Future work and Conclusions of CFTDedup --- p.43 / Chapter 8.1 --- Future Work --- p.43 / Chapter 8.2 --- Conclusions --- p.44 / Chapter 9 --- Conclusion --- p.45 / Bibliography --- p.47

This thesis explores the clock and data recovery (CDR) for the high-speed blind-sampling ADC-based receivers. This exploration results in two new CDR architectures that reduce the receiver complexity and save the ADC power and area compared to the previous work. The two proposed CDR architectures constitute the primary contributions of this thesis. The first proposed architecture, a 2x feed-forward CDR architecture, eliminates the interpolating feedback loop, used in the previously reported CDRs, in order to reduce the CDR circuit complexity. Instead of the feedback loop, the proposed architecture uses a feed-forward topology to recover the phase and data directly from the blind digital samples of the received signal. The 2x feed-forward CDR architecture was implemented and characterized in a 5 Gb/s receiver test-chip in 65 nm CMOS. The test-chip measurements confirm that the CDR successfully recovers the data with bit error rate (BER) < 10e-12 in the presence of jitter. The second proposed architecture, a fractional-sampling-rate (FSR) CDR architecture, reduces the receiver sampling rate from the typical integer rate of 2x the baud rate to a fractional rate between 2x and 1x in order to reduce the ADC power and area. This architecture employs the feed-forward topology of the first contribution of this thesis to recover the phase and data from the fractionally-spaced digital samples of the signal. To verify the proposed FSR CDR architecture, a 1.45x receiver test-chip was implemented and characterized in 65 nm CMOS. This test-chip recovers 6.875 Gb/s data from the ADC samples taken at 10 GS/s. The measurements confirm a successful data recovery in the presence of jitter with BER < 10e-12. With sampling at 1.45x, the FSR CDR architecture reduces the ADC power and area by 27.3% compared to the 2x feed-forward CDR architecture, while the overall receiver power and area are reduced by 12.5%.