Performance Aware Secure Code Partitioning Sri Hari Krishna Narayanan, Mahmut Kandemir, Richard Brooks Presenter : Sri Hari Krishna Narayanan

2 Outline Introduction to secure code partitioning Motivation through multi level security Our Code Partitioning Domain Workload Balancing Algorithm Example Results

3 Introduction Secure code partitioning is a process that partitions code and data among several mutually untrusted hosts that need to co-operate to complete a task in parallel. Original Application and data H0H0 H1H1 H2H2 H3H3 H4H4 Compiler thread Authenticated trust declarations

4 Why performance aware? - Secure code partitioning when performed in a performance agnostic manner can lead to skewed load across the hosts. Let us look at Multi-Level-Security (MLS) Uses qualifiers on data to classify them according to their sensitivity level. Uses qualifiers on hosts to classify them according to their capability level. Motivation – Multi level security Classic MLS lattice of 4 levels unclassified < confidential < secret < top secret Data A : (CONFIDENTIAL) Data B : (SECRET) Data C : (UNCLASSIFIED) Categories – Used to separate data COMINT, HUMINT, ELINT Data A : (CONFIDENTIAL, {ELINT}) Data B : (SECRET, {COMINT}) Data C : (UNCLASSIFIED, {HUMINT})

5 Multilevel Security Host A : (CONFIDENTIAL, {COMINT, HUMINT}) Host B : (CONFIDENTIAL, {ELINT}) Host C : (TOP SECRET, {COMINT, HUMINT, ELINT}) Data A : (CONFIDENTIAL, {ELINT}) Data B : (SECRET, {COMINT}) Data C : (UNCLASSIFIED, {HUMINT}) Data AData BData C COMINTHUMINTELINT TOP SECRET SECRET CONFIDENTIAL UNCLASSIFIED

6 Multilevel Security Host A : (CONFIDENTIAL, {COMINT, HUMINT}) Host B : (CONFIDENTIAL, {ELINT}) Host C : (TOP SECRET, {COMINT, HUMINT, ELINT}) Data A : (CONFIDENTIAL, {ELINT}) Data B : (SECRET, {COMINT}) Data C : (UNCLASSIFIED, {HUMINT}) Host C Host B Host C Host A Host C Data AData BData C COMINTHUMINTELINT TOP SECRET SECRET CONFIDENTIAL UNCLASSIFIED

7 Our Code Partitioning Domain The aim is to partition a given task evenly among a set of hosts. However, different hosts have access to different portions of the data. Further, hosts are hierarchically related. E.g. Host 1 can access all the data that Host 4 and Host 3 can. H2H2 H0H0 H1H1 H4H4 H3H3 H0H0 H2H2 H1H1 H4H4 H3H3 Data DecompositionsHost Hierarchy Tree

8 Compiler thread Our Code Partitioning Domain Original Application and Data H0H0 H1H1 H2H2 H3H3 H4H4 H2H2 H0H0 H1H1 H4H4 H4H4 H0H0 H2H2 H1H1 H4H4 H3H3

9 Workload Balancing Challenges There are three challenges Representing the data and computation that can be performed on them –In this work, we target codes that are structured as a series of loops that access data. –So the unit of workload distribution is a loop iteration. Calculating the initial/default workload on each host Reassigning the workload of the hosts –Three algorithms

10 Determining the data and the iterations Data accessed by a host in an iteration All iterations that access a particular data object on a host that may be accessed by a host All the iterations that may be executed on a host Default iterations that are executed on a host

11 Reassigning the workload The ideal average, N avg is calculated. BottomToTop allocates to every host, at most N avg iterations. TopToBottom increases the allowed number of iterations for unbalanced hosts. 1: N avg := Totalnumberofiterations / Totalnumberofhosts 2: BottomToTop(h root,N avg ) 3: while carryout(h root, I k ) > 0 do 4: N avg := N avg + N avg * 0.1 5: TopToBottom(h root,N avg, 0) 6: end while ReassignHHT()

12 Bottom To Top 1: for all H i in HHT visited in post-order fashion do 2: if H i is unbalanced then 3: Pass on iterations to the parent node 4: else 5: if H i is a leaf then 6: Mark H i as balanced 7: else 8: Temp:= N avg –H i ’ iterations 9: H i accepts Temp number of iterations from H i ’s children 10: end if 11: end if 12: end for

13 Top To Bottom 1: for all hosts in the HHT in pre-order fashion do 2: if H i is balanced then 3: Return 4: end if 5: if the increased iterations available to H i ’s parent balance Hi then 6: Mark H i as balanced 7: Return 8: else 9: carry reduce := 0 10: if the increased iterations available to H i balance it then 11: Mark H i as balanced 12: Return 13: else 14: Balance Hi as much as allowed. 15: Call TopToBottom on Hi’s children recursively if it is required to balance them. 16: end if 17: end if 18: end for

14 Example Based on the Gauss Seidel method H4H4 H1H1 H2H2 H0H0 H5H5 H6H6 H7H7 H3H3 H4H4 H1H1 H2H2 H0H0 H5H5 H6H6 H7H7 H3H3 for(i = 2 to N-1) for(j = 2 to N-1) B[i, j] := (A[i -1,j]+ A[i + 1,j] + A[i, j -1]+ A[i, j + 1]) * 1/ά ; endfor H2H2 H1H1 H3H3 H6H6 H7H7 H4H4 H2H2 H5H5 Array A Array BHHT

15 Example continued H0H0 H1H1 H3H3 H6H6 H7H7 H4H4 H2H2 H5H5 HHT

16 Example H 0 30 H 1 80 H 3 20 H 6 40 H 7 40 H 4 40 H 2 80 H 5 70 Assignment of initial iterations. N avg = 400/8 = 50 Maximum load on any node is 80. While the average is 50.

17 Example – Operation of BottomtoTop H 0 50 H 1 50 H 3 20 H 6 40 H 7 40 H 4 40 H 2 50 H Navg = 400/8 = > N avg ? H 1 80 H H 5 70 H 2 80

18 Example – Operation of BottomtoTop H 0 50 H 1 50 H 3 20 H 6 40 H 7 40 H 4 40 H 2 50 H Navg = 400/8 = 50 H 1 50 H 0 50

19 Example Toptobottom H 0 55 H 1 55 H 3 20 H 6 40 H 7 40 H 4 40 H 2 55 H H H 1 50 H H Balanced Increase allowed Load, N avg to 55

20 Example continued H 0 55 H 1 55 H 3 20 H 6 40 H 7 40 H 4 40 H 2 55 H

21 Example continued H 0 60 H 1 60 H 3 20 H 6 40 H 7 40 H 4 40 H 2 60 H Increase allowed load to 60

22 Example continued H 0 66 H 1 60 H 3 20 H 6 40 H 7 40 H 4 40 H 2 66 H Increase allowed load to 66

23 Example continued H 0 68 H 1 60 H 3 20 H 6 40 H 7 40 H 4 40 H 2 66 H Increase allowed load to 72 The HHT is now ‘balanced’ at the root node. Maximum load on any node is 68 (from 80).

24 Experimental Results Two metrics were studied for multiple HHTs Execution Time (EXE) Standard deviation of workload (STD) Two scenarios were studied Default data decomposition + multiple HHTs Default HHT + multiple decompositions

25 Experimental Results – (1/2) Default HHT + multiple decompositions Overall finish time for the different data decompositions with a default HHT. STD for the different data decompositions with a default HHT.

26 Experimental Results – (2/2) Default HHT + multiple decompositions Overall finish time for the different HHT with a default data decomposition STD for the different HHTs with a default data decompostion

27 Conclusion Showed that load balancing is required in secure code partitioning Proposed performance aware secure code partitioning to reduces the overall finish time. Better load balancing compared to the original method is achieved as well.

Thank you Sri Hari Krishna Narayanan