Approximate

Analysis

of

Reader/Writer

Queues

Theodore

Johnson

Dept.

of

CIS

University

of

Florida

Gainesville

Fl

September

Abstract

We

analyze

the

performance

of

queues

that

serve

readers

and

writers

Readers

are

served

concurrently

while

writers

require

exclusive

service

We

approximately

analyze

a

first-come-first-serve

-LRB-

FCFS

-RRB-

reader/writer

queue

and

derive

simple

formulae

for

computing

waiting

times

and

capacity

under

the

assumption

of

Poisson

arrivals

and

exponential

service

We

extend

the

analysis

to

handle

a

one-writer

queue

and

a

queue

that

includes

write-intention

locks

The

simple

analyses

that

we

present

can

be

used

as

rules-of-thumb

for

designing

concurrent

systems

Introduction

Most

analyses

of

database

or

operating

system

concurrency

control

algorithms

handle

only

the

case

of

exclusive

access

In

practice

however

many

concurrency

control

algorithms

use

both

shared

and

exclusive

locks

Shared

locks

are

important

for

increasing

concurrency

and

reducing

serialization

delays

This

paper

describes

queues

that

model

reader

and

writer

access

to

a

shared

resource

Readers

place

R

-LRB-

read

-RRB-

locks

and

writers

place

W

-LRB-

write

-RRB-

locks

Any

number

of

R

locks

may

be

held

simultaneously

but

only

one

W

lock

may

be

placed

at

a

given

time

In

addition

R

and

W

locks

are

incompatible

and

can

not

be

held

simultaneously

A

queuing

discipline

that

manages

the

lock

access

should

be

fair

so

that

readers

should

not

starve

writers

and

vice

versa

A

common

fairness

criterion

is

FCFS

That

is

if

lock

ff

arrives

before

lock

grant

ff

before

granting

The

FCFS

lock

queuing

mechanism

obeys

the

following

protocol

when

the

job

in

service

finishes

if

the

first

job

in

the

queue

is

a

reader

grant

access

to

all

readers

up

to

the

first

writer

If

the

first

job

is

a

writer

grant

the

lock

to

the

writer

In

addition

if

the

queue

is

empty

or

only

readers

are

in

service

and

a

reader

arrives

grant

a

lock

to

the

reader

-LRB-

see

figure

-RRB-

We

call

this

type

of

lock

queue

a

FCFS

reader/writer

queue

or

a

FCFS

r/w

queue

for

short

We

also

analyze

a

variation

on

the

FCFS

R/W

queue

In

the

variation

which

we

call

the

one-writer

queue

there

is

at

most

one

writer

in

the

queue

at

a

time

and

the

reader

arrival

rate

is

much

larger

than

the

writer

arrival

rate

The

one-writer

queue

has

many

applications

-LRB-

for

example

in

the

analysis

of

a

communications

driver

-LSB-

-RSB-

-RRB-

We

use

the

one-writer

queue

to

model

queues

with

write-intention

locks

or

R/U/W

queues

In

a

R/U/W

queue

the

incoming

stream

consists

of

R

and

U

locks

R

locks

are

compatible

both

with

each

other

and

with

U

locks

but

U

locks

are

not

compatible

with

each

other

U

locks

occasionally

upgrade

to

W

locks

which

are

exclusive

The

R/U/W

queue

can

model

write-intention

locks

which

are

often

used

for

concurrent

data

structures

-LSB-

-RSB-

and

for

multigranularity

locking

-LSB-

-RSB-

The

model

that

we

develop

predicts

the

expected

waiting

time

for

R

W

and

U

locks

In

addition

the

model

can

predict

the

probability

that

a

W

lock

is

in

the

queue

and

determine

whether

the

resource

can

serve

the

offered

load

Several

analyses

of

read

and

write

access

to

a

shared

resource

have

been

in

the

context

of

database

performance

-LSB-

-RSB-

For

example

Tay

-LSB-

-RSB-

handles

read-only

requests

by

modifying

the

formulae

for

the

probability

of

a

lock

conflict

and

assumes

that

queuing

for

shared

data

is

rare

The

problem

of

queuing

for

shared

data

has

been

modeled

in

the

context

of

replicated

databases

It

is

assumed

that

there

are

k

copies

of

a

file

and

two

different

copies

of

a

file

may

be

read

simultaneously

Coffman

et

al.

-LSB-

-RSB-

analyze

a

saturated

queue

in

which

a

write

request

preempts

all

current

readers

In

-LSB-

-RSB-

Coffman

Gelenbe

and

Plateau

analyze

the

same

queue

except

that

readers

may

begin

reading

a

copy

of

the

file

as

soon

as

it

has

been

written

Baccelli

and

Coffman

-LSB-

-RSB-

analyze

a

preemptive

queue

that

has

Poisson

arrivals

Nelson

and

Iyer

-LSB-

-RSB-

analyze

a

non-preemptive

queue

in

which

the

job

arrivals

are

Poisson

and

are

processed

in

FCFS

order

Read

operations

receive

exponentially

distributed

service

and

write

operations

receive

phase

distributed

service

-LRB-

the

exponential

distribution

is

an

example

of

a

phase

distribution

-RRB-

Nelson

and

Iyer

's

analysis

can

be

thought

of

as

an

exact

analysis

of

an

approximate

FCFS

R/W

queue

as

readers

and

writers

receive

FCFS

service

but

at

most

k

readers

may

be

served

simultaneously

This

analysis

requires

an

iteration

step

that

involves

multiplication

of

k

by

k

matrices

Courcoubetis

et

al.

-LSB-

-RSB-

analyze

queuing

systems

of

k

queues

in

which

ordinary

customers

require

service

from

only

one

queue

while

locking

customers

require

service

from

all

queues

simultaneously

Thomasian

and

Nicola

-LSB-

-RSB-

use

the

vacationing

server

model

to

study

the

optimal

control

of

a

reader/writer

queue

Courcoubetis

and

Reiman

-LSB-

-RSB-

use

a

system

of

k

queues

with

ordinary

and

locking

customers

to

study

the

optimal

control

of

a

reader/writer

queue

Reiman

and

Wright

-LSB-

-RSB-

provide

an

exact

analysis

of

the

stability

of

the

first

queueing

system

described

in

this

paper

permit

arbitrary

reader

and

writer

service

times

and

permit

the

writer

arrival

process

to

be

an

arbitrary

renewal

process

These

authors

also

provide

lower

and

upper

bounds

on

the

lock

waiting

times

and

a

heavy

traffic

approximation

This

paper

has

two

main

contributions

The

first

contribution

is

the

simple

formulae

for

predicting

the

capacity

and

the

waiting

times

of

the

FCFS

R/W

queuing

system

These

formulae

can

provide

simple

rules

of

thumb

for

designing

concurrent

systems

-LSB-

-RSB-

The

second

contribution

of

this

paper

is

the

analysis

of

the

one-writer

queue

and

the

R/U/W

queue

To

the

best

of

our

knowledge

these

queuing

systems

have

not

been

treated

before

An

Approximation

to

the

FCFS

R/W

Queue

The

difficulty

in

analyzing

the

reader/writer

queue

is

that

the

two

different

classes

of

customers

receive

different

types

of

service

The

writers

are

the

more

tractable

of

the

two

classes

because

they

receive

exclusive

FCFS

service

Therefore

we

approximate

the

reader/writer

queue

as

an

FCFS

queue

with

an

aggregate

customer

which

is

a

writer

together

with

all

readers

immediately

ahead

of

it

in

the

queue

The

aggregate

customer

has

an

arrival

rate

of

w

and

a

service

time

equal

to

the

service

time

for

a

writer

plus

the

service

time

for

all

of

the

readers

immediately

ahead

of

it

We

need

to

calculate

the

service

time

for

the

readers

that

entered

the

queue

before

the

entering

writer

and

after

the

previous

writer

There

are

two

cases

either

the

entering

writer

finds

another

writer

in

the

queue

or

no

writers

are

in

the

queue

If

another

writer

is

in

the

queue

the

entering

writer

must

wait

for

all

readers

that

entered

in

between

writer

arrivals

Otherwise

the

writer

must

wait

for

only

those

readers

that

survived

-LRB-

have

not

yet

finished

service

-RRB-

until

the

writer

entered

We

will

use

the

following

symbols

and

definitions

in

the

analysis

r

reader

arrival

rate

w

writer

arrival

rate

r

reader

service

rate

w

writer

service

rate

aew

probability

that

a

writer

is

in

the

queue

-LRB-

or

writer

utilization

-RRB-

Aw

expected

time

to

serve

an

aggregate

customer

-LRB-

a

writer

and

all

readers

that

arrived

after

the

previous

writer

for

which

the

current

writer

must

wait

-RRB-

a

Aw

ru

expected

time

that

a

writer

must

wait

for

readers

that

arrived

after

the

previous

writer

if

the

previous

writer

is

still

in

the

queue

upon

the

arrival

of

the

current

writer

re

expected

time

that

a

writer

must

wait

for

readers

that

arrived

after

the

previous

writer

if

the

previous

writer

finished

before

the

current

writer

arrived

Ww

expected

waiting

time

for

a

writer

Wr

expected

waiting

time

for

a

reader

Sr

-LRB-

n

-RRB-

time

to

serve

n

readers

Ar

-LRB-

t

-RRB-

number

of

readers

that

arrive

in

t

seconds

Tw

inter-arrival

time

of

a

writer

that

finds

another

writer

in

the

queue

Nr

number

of

surviving

readers

service

time

time

that

a

customer

spends

receiving

service

service

period

total

time

that

a

customer

spends

in

the

queue

-LRB-

service

time

waiting

time

-RRB-

The

main

result

of

this

section

is

Theorem

The

probability

that

a

writer

is

in

the

queue

aew

satisfies

aew

w

w

aew

r

ln

aew

r

w

aew

r

ln

-LRB-

aew

-RRB-

r

r

w

w

-LRB-

-RRB-

Some

results

that

we

will

need

to

perform

the

analysis

are

Lemma

Let

Sr

-LRB-

n

-RRB-

be

the

time

for

n

concurrent

readers

to

be

served

where

each

reader

is

served

concurrently

at

rate

r

Then

d

dt

Pr

-LSB-

Sr

-LRB-

n

-RRB-

t

-RSB-

n?r

n

X

i

n

i

-LRB-

-RRB-

i

i?rt

-LRB-

-RRB-

Proof

We

model

this

situation

by

a

pure-death

process

Let

state

k

be

the

condition

that

there

are

k

readers

left

and

let

Pk

-LRB-

t

-RRB-

be

the

probability

that

the

system

is

in

state

k

at

time

t

k

n

t

If

the

system

is

in

state

k

at

time

t

then

a

reader

will

die

at

rate

k?r

In

this

model

-LRB-

t

-RRB-

Pr

-LSB-

Sr

-LRB-

n

-RRB-

t

-RSB-

The

description

of

the

system

leads

to

the

following

system

of

differential

equations

dPn

-LRB-

t

-RRB-

dt

n?rPn

-LRB-

t

-RRB-

dPk

-LRB-

t

-RRB-

dt

k?rPk

-LRB-

t

-RRB-

-LRB-

k

-RRB-

rPk

-LRB-

t

-RRB-

k

n

-LRB-

t

-RRB-

dt

-LRB-

t

-RRB-

For

our

initial

conditions

we

have

Pn

-LRB-

-RRB-

and

Pk

-LRB-

-RRB-

if

k

n.

From

this

the

solution

to

the

differential

equations

is

Pn

-LRB-

t

-RRB-

e?n?rt

Pk

-LRB-

t

-RRB-

e?k?rt

-LRB-

k

-RRB-

r

R

Pk

-LRB-

x

-RRB-

ek?rxdx

k

n

The

solution

to

this

recurrence

is

Pk

-LRB-

t

-RRB-

nk

hPni

k

n?k

i?k

-LRB-

-RRB-

i?ke?i?rti

The

last

of

the

differential

equations

tells

us

that

-LRB-

t

-RRB-

dt

-LRB-

t

-RRB-

or

that

d

Pr

-LSB-

Sr

-LRB-

n

-RRB-

t

-RSB-

dt

n?r

n

X

i

n

i

-LRB-

-RRB-

i

i?rt

ffl

Corollary

E

-LSB-

Sr

-LRB-

n

-RRB-

-RSB-

r

n

X

i

i

-LRB-

-RRB-

Proof

E

-LSB-

Sr

-LRB-

n

-RRB-

-RSB-

R

tn?r

hPni

n

i

-LRB-

-RRB-

i

i?rti

dt

nPni

n

i

-LRB-

-RRB-

i

-LRB-

i

-RRB-

R

i?rte?i?rtdt

nPni

n

i

-LRB-

-RRB-

i

-LRB-

i

-RRB-

-LRB-

i?r

-RRB-

r

Pni

ni

-LRB-

-RRB-

i

-LRB-

i

-RRB-

r

Pni

i

where

the

last

step

is

just

the

application

of

the

combinatorial

identity

found

in

-LSB-

-RSB-

page

ffl

With

these

tools

we

can

calculate

the

expected

time

needed

to

serve

all

readers

in

front

of

a

writer

W

if

another

writer

is

in

the

queue

when

W

enters

We

need

to

calculate

the

number

of

readers

that

entered

the

queue

before

the

entering

writer

and

after

the

previous

writer

Suppose

the

time

between

writer

arrivals

is

t.

Let

the

random

variable

Ar

-LRB-

t

-RRB-

be

the

number

of

readers

that

arrive

in

t

seconds

The

readers

have

a

Poisson

arrival

rate

so

Ar

-LRB-

t

-RRB-

has

the

distribution

Pr

-LSB-

Ar

-LRB-

t

-RRB-

k

-RSB-

-LRB-

r

t

-RRB-

k

k

e

rt

To

calculate

the

distribution

of

the

number

of

readers

that

arrive

between

the

arrival

of

two

writers

we

find

the

unconditional

distribution

of

Ar

For

this

we

need

to

know

the

distribution

of

t

The

probability

that

the

inter-arrival

period

lasts

at

least

t

seconds

given

that

the

arriving

writer

finds

at

least

one

other

writer

in

the

queue

is

the

probability

that

the

inter-arrival

period

lasts

at

least

t

seconds

and

the

service

period

-LRB-

waiting

time

plus

service

time

-RRB-

of

the

previous

writer

lasts

at

least

t

seconds

Let

Tw

be

the

random

variable

that

represents

the

interarrival

time

of

writers

that

find

the

queue

utilized

Then

d

dt

Pr

-LSB-

Tw

t

-RSB-

K

d

dt

Pr

-LSB-

interarrival

time

t

-RSB-

Pr

-LSB-

previous

writer

still

in

queue

-RSB-

where

K

is

a

normalizing

constant

Suppose

that

we

already

know

the

expected

service

time

of

an

aggregate

customer

a

and

the

probability

that

a

writer

is

in

the

queue

aew

w

a

If

we

model

the

aggregate

queue

as

an

queue

then

we

know

that

the

service

period

distribution

-LRB-

waiting

time

and

service

time

-RRB-

is

-LSB-

-RSB-

Pr

-LSB-

S

-LRB-

t

-RRB-

t

-RSB-

e

a

-LRB-

aew

-RRB-

t

The

probability

that

the

previous

writer

has

not

been

served

in

t

seconds

is

S

-LRB-

t

-RRB-

so

we

have

d

dt

Pr

-LSB-

Tw

t

-RSB-

K

we

wt

e

a

-LRB-

aew

-RRB-

t

ae

at

Using

this

distribution

for

Tw

we

get

Pr

-LSB-

Ar

k

-RSB-

R

Pr

-LSB-

Ar

-LRB-

t

-RRB-

k

-RSB-

ddt

Pr

-LSB-

Tw

t

-RSB-

dt

R

-LRB-

rt

-RRB-

k

k

e

rt?ae

atdt

kr

a

k

R

tke

-LRB-

r

a

-RRB-

tdt

kr

a

k

k

-LRB-

r

a

-RRB-

k

a

r

a

r

r

a

k

-LRB-

-RRB-

This

leads

to

Lemma

The

expected

time

to

serve

all

readers

in

front

of

a

writer

arriving

in

a

queue

that

already

contains

a

writer

is

ru

E

-LSB-

Sr

-RSB-

r

ln

aew

r

w

-LRB-

-RRB-

Proof

We

randomize

Sr

using

Ar

and

calculate

the

unconditional

expectation

E

-LSB-

Sr

-RSB-

a

r

-LRB-

a

r

-RRB-

r

a

r

k

Pki

-LRB-

i

-RRB-

In

order

to

solve

this

sum

we

apply

Abel

's

transformation

-LRB-

-LSB-

-RSB-

page

-RRB-

n

X

k

Xk

k

X

r

Yr

Xn

n

X

k

Yk

n

X

k

XkYk

Let

a

r

=-LRB-

a

r

-RRB-

Xk

ak

and

Yr

r

Then

Xk

ak

-LRB-

a

-RRB-

and

k

X

k

ak

kX

r

r

a

an

n

X

k

k

n

X

k

ak

k

Since

a

as

n

an

Pnk

k

and

using

the

well-known

expansion

ln

-LRB-

x

-RRB-

-LRB-

-RRB-

i

xi

i

n

X

k

ak

k

ln

a

We

substitute

in

the

value

of

a

substitute

w

aew

for

a

and

multiply

by

the

leading

constants

to

get

ru

E

-LSB-

Sr

-RSB-

r

ln

r

a

a

r

ln

aew

r

w

ffl

Next

we

must

calculate

the

expected

waiting

time

for

serving

the

readers

in

the

case

in

which

the

writer

enters

the

queue

and

finds

only

readers

in

the

queue

We

can

not

use

the

expected

value

already

calculated

because

some

of

the

readers

may

have

left

the

queue

before

the

writer

enters

the

queue

The

calculation

of

the

distribution

of

the

number

of

readers

in

the

queue

when

the

writer

arrives

is

intractable

Instead

of

the

distribution

we

will

calculate

the

expected

number

of

readers

still

in

the

queue

Consider

three

points

in

time

A

B

C

with

respect

to

a

particular

writer

W

who

enters

the

queue

and

finds

no

other

writers

in

the

queue

Occasion

A

is

the

point

when

the

previous

writer

entered

the

queue

occasion

B

is

the

point

when

the

previous

writer

left

the

queue

and

occasion

C

is

the

point

when

W

enters

the

queue

-LRB-

see

Figure

-RRB-

Because

reader

arrivals

and

departures

are

independent

we

will

consider

the

expected

number

of

surviving

readers

from

-LRB-

A

B

-RRB-

and

from

-LRB-

B

C

-RRB-

separately

We

need

to

know

the

lengths

of

the

intervals

-LRB-

A

B

-RRB-

and

-LRB-

B

C

-RRB-

The

arrival

distribution

is

memoryless

so

the

length

of

-LRB-

B

C

-RRB-

has

an

exponential

distribution

with

parameter

w

We

find

the

approximation

to

the

distribution

of

the

length

of

-LRB-

A

B

-RRB-

the

same

way

we

found

the

approximation

to

the

distribution

of

Tw

The

probability

that

-LRB-

A

B

-RRB-

lasts

at

least

t

seconds

is

the

probability

that

the

previous

writer

's

service

period

lasts

at

least

t

seconds

and

the

writer

interarrival

time

is

at

least

t

seconds

d

dt

Pr

-LSB-

j

-LRB-

A

B

-RRB-

j

t

-RSB-

K?a

-LRB-

aew

-RRB-

e

a

-LRB-

aew

-RRB-

te

wt

ae

a

Consider

the

survivors

from

-LRB-

B

C

-RRB-

first

The

probability

that

a

reader

enters

the

queue

during

time

-LRB-

o

o

do

-RRB-

is

r

do

A

reader

that

entered

the

queue

o

seconds

before

C

will

survive

with

probability

e

ro

Therefore

the

expected

number

of

surviving

readers

if

-LRB-

B

C

-RRB-

is

t

seconds

long

is

E

-LSB-

NBC

r

-LRB-

t

-RRB-

-RSB-

R

r

e

rodo

r?r

-LRB-

e

rt

-RRB-

The

unconditional

distribution

of

NBC

r

becomes

E

-LSB-

NBC

r

-RSB-

R

r?r

-LRB-

e

r

t

-RRB-

we

wt

dt

r

w

r

-LRB-

-RRB-

Next

consider

the

survivors

from

-LRB-

A

B

-RRB-

The

expected

number

of

survivors

from

-LRB-

A

B

-RRB-

is

the

expected

number

of

readers

that

arrived

in

-LRB-

A

B

-RRB-

then

survived

through

-LRB-

B

C

-RRB-

Suppose

that

the

probability

of

surviving

-LRB-

B

C

-RRB-

is

p

Then

if

k

readers

arrived

in

-LRB-

A

B

-RRB-

the

expected

number

of

survivors

NAB

r

-LRB-

k

p

-RRB-

equals

kp

To

remove

the

dependence

of

NAB

r

-LRB-

k

p

-RRB-

on

k

we

need

to

know

the

distribution

of

the

number

of

arrivals

in

-LRB-

A

B

-RRB-

Since

the

distribution

of

j

-LRB-

A

B

-RRB-

j

has

the

same

distribution

as

Tuw

the

number

of

readers

that

arrive

in

-LRB-

A

B

-RRB-

has

the

same

distribution

as

Ar

NAB

r

-LRB-

p

-RRB-

kp

Pr

-LSB-

Ar

k

-RSB-

kp

a

r

a

r

r

a

k

rp

a

If

the

interval

-LRB-

B

C

-RRB-

is

t

seconds

long

the

probability

of

surviving

is

e

rt.

Using

this

to

get

the

unconditional

distribution

of

NAB

r

we

get

NAB

r

R

r?a

e

r

t

we

wtdt

aew

r

r

w

-LRB-

-RRB-

The

expected

number

of

survivors

when

W

arrives

is

Nr

NAB

r

NBC

r

-LRB-

aew

-RRB-

r

r

w

-LRB-

-RRB-

In

order

to

calculate

the

expected

waiting

time

we

assume

that

the

number

of

surviving

readers

has

a

geometric

distribution

with

mean

-LRB-

aew

-RRB-

r

=-LRB-

r

w

-RRB-

If

is

then

number

of

surviving

readers

then

Pr

-LSB-

k

-RSB-

r

w

-LRB-

aew

-RRB-

r

r

w

-LRB-

aew

-RRB-

r

-LRB-

aew

-RRB-

r

r

w

k

We

can

calculate

the

mean

in

the

same

manner

as

in

Lemma

to

get

Lemma

The

expected

time

to

serve

all

readers

in

front

of

a

writer

that

finds

no

other

writers

in

the

queue

when

it

arrives

is

re

r

ln

-LRB-

aew

-RRB-

r

r

w

-LRB-

-RRB-

Now

we

know

that

the

expected

service

time

for

the

aggregate

customer

is

Aw

a

w

aewru

-LRB-

aew

-RRB-

re

If

we

use

the

fact

that

aew

wAw

and

the

values

of

re

and

ru

we

get

aew

w

w

aew

r

ln

aew

r

w

aew

r

ln

-LRB-

aew

-RRB-

r

r

w

w

-LRB-

-RRB-

Proving

Theorem

To

find

aew

we

find

the

root

of

aew

in

the

above

equation

This

can

be

done

iteratively

or

with

a

nonlinear

equation

solving

package

The

queue

will

be

stable

if

aew

Once

the

correct

aew

has

been

found

we

can

try

solving

the

queue

as

an

queue

with

arrival

rate

w

and

service

rate

Aw

In

this

system

the

expected

waiting

time

is

-LRB-

aewAw

-RRB-

-LRB-

aew

-RRB-

The

waiting

time

of

an

aggregate

customer

is

the

waiting

time

of

a

reader

but

a

writer

must

also

wait

for

all

readers

ahead

of

it

to

finish

so

Corollary

If

the

aggregate

queue

is

modeled

as

an

queue

the

expected

waiting

times

for

the

reader

and

writer

customers

are

Wr

-LRB-

aewAw

-RRB-

-LRB-

aew

-RRB-

-LRB-

-RRB-

Ww

-LRB-

aewAw

-RRB-

-LRB-

aew

-RRB-

aewru

-LRB-

aew

-RRB-

re

-LRB-

-RRB-

Model

We

can

also

consider

the

server

as

a

network

of

exponential

stages

With

probability

aew

service

is

for

an

expected

w

seconds

then

for

an

expected

ru

seconds

With

probability

aew

service

is

for

an

expected

w

seconds

then

for

an

expected

re

seconds

The

Laplace

transform

of

the

service

time

of

this

server

is

given

by

B

-LRB-

s

-RRB-

w

s

w

aew

rus

-LRB-

aew

-RRB-

res

The

expected

waiting

time

for

a

queue

is

given

by

-LRB-

-LSB-

-RSB-

pg

-RRB-

W

-LRB-

ae

-RRB-

where

x

is

the

service

time

at

the

server

The

value

of

can

be

found

by

differentiating

the

Laplace

transform

twice

and

evaluating

at

zero

This

gives

Corollary

If

the

aggregate

queue

is

modeled

as

an

queue

the

expected

waiting

times

for

the

reader

and

writer

customers

are

Wr

w

aew

h

aew

ru?w

-LRB-

aew

-RRB-

re?w

i

-LRB-

-RRB-

Ww

Wr

aewru

-LRB-

aew

-RRB-

re

-LRB-

-RRB-

Maximum

Throughput

Theorem

can

be

used

to

predict

the

maximum

throughput

Corollary

At

the

maximum

throughput

w

r

w

and

r

satisfy

r

w

e?r

-LRB-

w

w

-RRB-

-LRB-

-RRB-

Proof

Set

aew

in

Theorem

and

solve

for

r

ffl

We

note

that

this

stability

condition

is

the

same

as

that

derived

in

-LSB-

-RSB-

As

an

application

we

can

find

the

maximum

throughput

of

the

queue

when

the

proportion

of

readers

to

writers

is

constant

Corollary

If

r

w

a

then

the

maximum

writer

arrival

rate

is

w

r?w

w

ln

-LRB-

a

-RRB-

r

-LRB-

-RRB-

Corollary

implies

that

if

a

e

increasing

the

reader

service

rate

is

better

than

increasing

the

writer

service

rate

If

a

e

the

opposite

is

true

Theorem

can

also

be

used

to

find

the

arrival

rates

such

that

aew

aew

etc.

Comparison

and

Experiments

A

R/W

queue

simulator

was

built

and

experiments

run

Six

hundred

thousand

samples

were

taken

The

results

of

the

simulator

were

then

compared

to

analytical

results

Table

shows

a

comparison

between

the

model

and

the

simulation

The

analytical

calculation

of

aew

-LRB-

and

therefore

of

ru

and

re

-RRB-

is

usually

close

to

the

results

of

the

simulator

The

match

is

best

when

r

ss

w

and

becomes

worse

when

r

is

much

larger

than

w

This

can

be

seen

in

Figure

The

model

gives

good

predictions

of

the

expected

lock

waiting

times

when

r

ss

w

As

r

increases

the

waiting

times

predicted

by

the

model

tend

to

become

pessimistic

as

can

be

seen

in

Figure

Table

shows

a

comparison

between

the

model

and

the

simulation

If

r

AE

w

then

the

model

is

a

better

approximation

than

the

model

When

the

rate

of

reader

arrivals

is

close

to

the

rate

of

writer

arrivals

the

aggregate

customer

has

a

service

distribution

that

can

be

approximated

well

by

an

exponential

distribution

When

the

rate

of

reader

arrivals

becomes

large

the

contribution

of

the

readers

to

the

service

time

becomes

greater

and

the

service

time

distribution

is

better

approximated

by

the

hyperexponential

distribution

A

rule

of

thumb

for

choosing

the

best

model

to

use

is

the

following

Rule

of

thumb

If

r

w

use

the

model

otherwise

use

the

model

Figures

and

show

how

the

maximum

writer

and

reader

arrival

rate

decreases

with

an

increasing

reader

and

writer

arrival

rate

respectively

The

graphs

show

a

cutoff

point

in

the

writer

arrival

rate

after

which

the

reader

arrival

rate

may

be

increased

almost

arbitrarily

as

the

writer

arrival

rate

decreases

This

is

largely

due

to

the

fact

that

re

and

ru

depend

logarithmically

on

r

so

that

further

increases

in

the

aggregate

customer

's

service

time

require

exponential

increases

in

the

reader

arrival

rate

The

One-Writer

Queue

In

this

section

we

analyze

a

reader/writer

queue

in

which

at

most

one

writer

is

ever

in

the

queue

The

protocol

of

the

one-writer

queue

is

the

same

as

for

the

FCFS

R/W

queue

FCFS

and

readers

are

served

concurrently

Further

we

assume

that

writers

arrive

rarely

compared

to

readers

Let

us

calculate

E

-LSB-

Ww

-RSB-

the

expected

waiting

time

for

a

W

lock

We

need

to

know

the

distribution

of

the

number

of

R

locks

in

front

of

the

W

lock

when

the

W

lock

enters

the

queue

If

W

locks

arrive

rarely

the

distribution

of

the

number

of

R

locks

in

the

queue

will

approach

a

steady-state

M

M

distribution

If

Nr

is

the

number

of

R

locks

in

the

queue

when

a

W

lock

arrives

then

from

-LSB-

-RSB-

Pr

-LSB-

Nr

k

-RSB-

-LRB-

r

r

-RRB-

k

k

e

r

r

-LRB-

-RRB-

Let

Ww

-LRB-

n

-RRB-

be

the

waiting

time

for

a

W

lock

if

n

R

locks

are

in

the

queue

when

the

W

lock

enters

Then

from

Corollary

E

-LSB-

Ww

-LRB-

n

-RRB-

-RSB-

r

Pni

i

Combining

-LRB-

-RRB-

and

Corollary

the

unconditional

distribution

of

Ww

is

E

-LSB-

Ww

-RSB-

e

r

r

r

-LRB-

r

r

-RRB-

k

k

Pni

i

-LRB-

-RRB-

In

-LSB-

-RSB-

we

find

the

formula

X

n

xn

n

n

X

i

i

ex

-LRB-

-RRB-

n

n

-LRB-

n

-RRB-

ex

R

-LRB-

e?t

-RRB-

t

-LRB-

x

-RRB-

-LRB-

-RRB-

The

exponential

integral

can

be

algebraically

obtained

from

-LRB-

x

-RRB-

so

we

ca

n't

expect

to

simplify

-LRB-

x

-RRB-

into

a

closed

form

Combining

-LRB-

-RRB-

and

-LRB-

-RRB-

we

get

Theorem

The

expected

waiting

time

for

a

W

lock

in

a

one-writer

queue

is

E

-LSB-

Ww

-RSB-

-LRB-

r

r

-RRB-

r

-LRB-

-RRB-

Let

us

next

calculate

the

expected

waiting

time

for

a

R

lock

An

R

lock

waits

only

if

there

is

a

W

lock

in

the

queue

ahead

of

it

If

the

R

lock

arrives

when

the

W

lock

is

in

service

the

R

lock

will

have

to

wait

for

the

renewal

time

of

the

W

lock

service

Since

we

are

assuming

exponentially

distributed

service

times

the

expected

renewal

time

is

w

The

probability

that

the

R

lock

will

arrive

when

a

W

lock

is

in

service

is

W

W

An

R

lock

will

arrive

while

the

W

lock

is

waiting

with

probability

E

-LSB-

Ww

-RSB-

W

-LRB-

as

there

is

at

most

one

W

lock

in

the

queue

at

a

time

-RRB-

The

R

lock

will

have

to

wait

for

the

service

time

of

the

W

lock

-LRB-

W

-RRB-

plus

the

remaining

time

to

serve

the

readers

ahead

of

the

W

lock

This

is

the

renewal

time

of

the

W

waiting

time

distribution

From

-LSB-

-RSB-

this

is

given

by

-LRB-

-RRB-

where

is

the

first

moment

of

the

waiting

time

distribution

and

is

the

second

moment

We

have

already

calculated

the

first

moment

-LRB-

E

-LSB-

Ww

-RSB-

-RRB-

so

all

we

need

to

do

is

calculate

the

second

moment

From

Lemma

the

distribution

of

the

time

for

n

readers

to

finish

service

is

d

dt

Pr

-LSB-

Sr

-LRB-

n

-RRB-

t

-RSB-

n?r

n

X

i

n

i

-LRB-

-RRB-

i

i?rt

Using

the

distribution

of

the

number

of

readers

-LRB-

-RRB-

the

distribution

of

Ww

is

d

dt

Pr

-LSB-

Ww

t

-RSB-

e

r

r

-LRB-

r

r

-RRB-

n

n

n?r

hPni

n

i

-LRB-

-RRB-

i

i?rti

Next

we

find

the

second

moment

E

-LSB-

W

-RSB-

R

e

r

r

-LRB-

r

r

-RRB-

n

n

n?r

hPni

n

i

-LRB-

-RRB-

i

i?rti?o

dt

e

r

r

n

-LRB-

r

r

-RRB-

n

n

nPni

h?n

i

-LRB-

-RRB-

i

-LRB-

i

-RRB-

R

io

e

r

r

n

-LRB-

r

r

-RRB-

n

n

nPni

h?n

i

-LRB-

-RRB-

i

-LRB-

i

-RRB-

-LRB-

i?r

-RRB-

io

r

r

-LRB-

r

r

-RRB-

n

n

Pni

ni

-LRB-

-RRB-

i

In

order

to

simplify

the

sum

let

us

express

n

X

i

n

i

-LRB-

-RRB-

i

as

a

recursive

relation

gn

Pnk

-LRB-

-RRB-

k

nk

Pnk

-LRB-

-RRB-

k

h?n

k

n

k

i

Pnk

-LRB-

-RRB-

k

n

k

Pnk

nk

-LRB-

-RRB-

k

k

Since

n

n

the

first

sum

is

simply

gn

From

-LSB-

-RSB-

the

second

sum

is

just

H

-LRB-

n

-RRB-

Pni

i.

Therefore

gn

gn

Pnj

-LRB-

-RRB-

Pni

Pij

-LRB-

-RRB-

Our

problem

reduces

to

finding

a

simpler

form

of

V

-LRB-

x

-RRB-

xn

n

Pni

Pij

j

gn

xn

n

The

gn

function

has

a

simple

difference

This

suggests

that

we

consider

V

-LRB-

x

-RRB-

to

be

the

exponential

generating

function

of

gn

and

try

to

find

a

relationship

that

leads

to

a

solution

for

V

-LRB-

x

-RRB-

The

derivative

operator

will

let

us

calculate

a

difference

in

an

exponential

generating

function

Assuming

that

dV

dx

V

-LRB-

x

-RRB-

ngn

xn

n

gn

xn

n

-LRB-

gn

gn

-RRB-

xn

n

n

Pn

i

xn

n

Pni

xn

n

ex

x

-LRB-

x

-RRB-

V

-LRB-

x

-RRB-

satisfies

a

first-order

linear

differential

equation

so

we

can

apply

the

formula

for

the

solution

of

first

order

linear

differential

equations

-LSB-

-RSB-

dV

dx

P

-LRB-

x

-RRB-

V

-LRB-

x

-RRB-

Q

-LRB-

x

-RRB-

-RRB-

V

-LRB-

x

-RRB-

e?R

P

dx

Z

Qe

R

P

dxdx

c

Since

P

-LRB-

x

-RRB-

R

P

-LRB-

x

-RRB-

dx

x.

Therefore

V

-LRB-

x

-RRB-

ex

R

ex

x

-LRB-

x

-RRB-

e?x

dx

c

ex

R

-LRB-

-RRB-

nxn

n

-LRB-

n

-RRB-

dx

c

ex

-LRB-

-RRB-

n

-LRB-

n

-RRB-

c

In

order

to

find

the

value

of

the

constant

c

evaluate

V

-LRB-

-RRB-

and

find

that

c

Therefore

V

-LRB-

x

-RRB-

ex

X

n

-LRB-

-RRB-

n

-LRB-

x

-RRB-

-LRB-

-RRB-

The

function

-LRB-

x

-RRB-

is

also

a

transcendental

function

so

we

can

not

hope

to

simplify

V

-LRB-

x

-RRB-

further

By

using

the

formula

for

V

-LRB-

x

-RRB-

-LRB-

-RRB-

and

the

formula

for

the

renewal

time

-LRB-

-RRB-

we

get

Lemma

The

expected

residual

time

of

Ww

is

-LSB-

Ww

-RSB-

-LRB-

r

r

-RRB-

-LRB-

r

r

-RRB-

Now

that

we

have

calculated

-LSB-

Ww

-RSB-

we

can

calculate

E

-LSB-

Wr

-RSB-

by

E

-LSB-

Wr

-RSB-

w

w

w

E

-LSB-

Ww

-RSB-

w

-LRB-

w

-LSB-

Ww

-RSB-

-RRB-

which

gives

Theorem

The

expected

wait

for

a

reader

in

the

one-writer

queue

is

E

-LSB-

Wr

-RSB-

w

-LRB-

r

r

-RRB-

r?w

-LRB-

r

r

-RRB-

-LRB-

-RRB-

The

throughput

of

the

one-writer

queue

is

limited

by

the

arrival

rate

at

which

there

always

is

a

writer

in

the

queue

The

expected

length

of

time

that

a

W

lock

is

in

the

queue

is

w

E

-LSB-

Ww

-RSB-

Using

Theorem

we

get

Corollary

The

throughput

of

the

one-writer

queue

is

limited

by

w

max

r?w

r

-LRB-

r

r

-RRB-

-LRB-

-RRB-

Proof

When

the

arrival

rate

over

the

service

rate

equals

one

there

will

always

be

a

W

lock

in

the

queue

Therefore

the

arrival

rate

must

be

less

than

or

equal

to

the

service

rate

ffl

Asymptotics

The

functions

-LRB-

x

-RRB-

and

-LRB-

x

-RRB-

are

transcendental

functions

so

they

can

not

be

simplified

into

familiar

functions

Their

power

series

forms

are

n't

completely

satisfactory

for

calculations

either

While

both

and

grow

slowly

the

maximum

terms

in

their

power

series

grow

rapidly

so

that

for

even

relatively

small

values

of

x

-LRB-

about

-RRB-

limited

precision

algorithms

can

not

calculate

the

functions

Fortunately

both

and

have

simple

asymptotic

representations

The

function

-LRB-

x

-RRB-

is

related

to

the

exponential

integral

by

-LRB-

x

-RRB-

ln

-LRB-

x

-RRB-

-LRB-

x

-RRB-

where

-LRB-

x

-RRB-

is

the

exponential

integral

-LSB-

-RSB-

-LRB-

x

-RRB-

Z

x

e?t

t

dt

has

the

following

asymptotic

expansion

-LSB-

-RSB-

-LRB-

x

-RRB-

e?x

x

-LSB-

x

-LRB-

-RRB-

nn

xn

Rn

-LRB-

x

-RRB-

where

Rn

-LRB-

x

-RRB-

-LRB-

-RRB-

n

-LRB-

n

-RRB-

x?n

n

-LRB-

x

-RRB-

n

-LRB-

x

-RRB-

If

we

use

the

first

asymptotic

expansion

-LRB-

use

-LRB-

x

-RRB-

-RRB-

we

can

bound

-LRB-

x

-RRB-

by

-LRB-

x

-RRB-

e?x

x

Therefore

we

can

approximate

-LRB-

x

-RRB-

by

-LRB-

x

-RRB-

ss

ln

-LRB-

x

-RRB-

-LRB-

-RRB-

with

an

error

of

less

than

e?x

x

We

can

use

the

asymptotic

form

of

-LRB-

x

-RRB-

to

get

an

asymptotic

formula

for

-LRB-

x

-RRB-

by

integrating

Since

-LRB-

x

-RRB-

has

a

zero

at

x

-LRB-

x

-RRB-

x

has

a

removable

singularity

at

x

If

-LRB-

x

-RRB-

is

expressed

as

ln

-LRB-

x

-RRB-

-LRB-

x

-RRB-

then

as

x

ln

-LRB-

x

-RRB-

and

-LRB-

x

-RRB-

Therefore

break

the

interval

of

integration

-LSB-

x

-RSB-

into

two

parts

-LSB-

a

-RRB-

and

-LSB-

a

x

-RSB-

On

the

first

interval

we

integrate

the

power

series

representation

of

-LRB-

x

-RRB-

and

get

the

value

-LRB-

a

-RRB-

On

the

second

interval

we

integrate

the

asymptotic

form

of

-LRB-

x

-RRB-

ss

-LRB-

a

-RRB-

R

xa

ln

-LRB-

t

-RRB-

t

dt

-LRB-

-LRB-

a

-RRB-

ln

-LRB-

a

-RRB-

ln

-LRB-

a

-RRB-

-RRB-

ln

-LRB-

x

-RRB-

ln

-LRB-

x

-RRB-

ln

-LRB-

x

-RRB-

ln

-LRB-

x

-RRB-

-LRB-

-RRB-

The

constant

ss

can

be

evaluated

by

using

the

power

series

of

to

evaluate

-LRB-

a

-RRB-

The

error

is

bounded

by

error

-LRB-

a

-RRB-

R

a

-LRB-

x

-RRB-

x

dx

R

a

e?x

e?a

The

Reader/Write-Upgrade/Writer

Queue

In

this

section

we

use

the

results

of

section

to

analyze

the

reader/write-upgrade/writer

queue

The

R/U/W

queue

uses

three

types

of

locks

read

write-upgrade

and

write

locks

which

we

abbreviate

sa

R

U

and

W

locks

respectively

W

denote

the

arrival

rates

of

the

R

and

U

locks

by

R

and

U

respectively

We

assume

that

some

proportion

of

the

U

locks

upgrade

to

W

locks

We

denote

the

service

rates

of

the

R

and

W

locks

by

R

and

W

respectively

The

service

time

of

a

U

lock

depends

on

the

waiting

time

of

a

W

lock

We

assume

that

the

r

AE

u

and

that

U

locks

are

rarely

upgraded

to

W

locks

The

result

is

that

r

AE

w

and

that

writer

arrivals

are

rare

Because

of

the

assumptions

the

results

of

the

previous

section

apply

-LRB-

The

assumptions

are

safe

when

the

queue

is

applied

to

concurrent

B-tree

algorithms

for

example

-LSB-

-RSB-

-RRB-

The

R

locks

will

be

blocked

only

by

a

W

lock

A

U

lock

may

be

blocked

by

a

W

lock

or

by

another

U

lock

A

W

lock

comes

from

a

conversion

request

from

the

current

U

lock

only

and

is

blocked

by

all

of

the

R

locks

currently

in

service

Thus

R

locks

block

U

locks

only

by

blocking

a

W

lock

conversion

This

leads

us

to

consider

strategy

of

modeling

the

R/U/W

queue

as

two

queues

one

for

the

R

and

W

locks

and

one

for

the

U

locks

In

the

R/W

queue

R

locks

are

served

simultaneously

If

a

W

lock

enters

the

queue

the

W

lock

must

wait

for

the

preceding

R

locks

to

finish

service

before

obtaining

control

of

the

queue

All

R

locks

that

enter

the

queue

after

the

W

lock

must

wait

until

the

W

lock

finishes

service

In

the

U

queue

U

locks

receive

FCFS

service

The

U

lock

in

service

might

be

upgraded

to

a

W

lock

The

W

lock

blocks

all

U

locks

Therefore

the

R/W

queue

and

the

U

queue

are

coupled

by

increasing

the

service

time

for

a

U

lock

by

the

expected

service

period

-LRB-

waiting

time

and

service

time

-RRB-

of

a

W

lock

We

can

now

list

the

waiting

times

for

the

three

types

of

locks

W

the

waiting

time

for

a

W

lock

is

the

time

for

all

preceding

R

locks

to

finish

R

the

waiting

time

for

an

R

lock

is

Pr

-LSB-

W

lock

is

waiting

-RSB-

-LSB-

-LRB-

W

service

-RRB-

-LRB-

time

for

surviving

R

's

to

finish

-RRB-

-RSB-

Pr

-LSB-

W

lock

in

service

-RSB-

-LRB-

time

for

W

to

finish

service

-RRB-

U

the

waiting

time

for

a

U

lock

is

the

the

waiting

time

for

a

customer

in

a

FCFS

queue

The

arrival

rate

is

U

and

the

service

time

is

Pr

-LSB-

no

W

conversion

-RSB-

T

-LSB-

serve

U

j

no

W

conversion

-RSB-

Pr

-LSB-

W

conversion

-RSB-

-LRB-

T

-LSB-

serve

U

j

W

conversion

-RSB-

-LRB-

W

service

period

-RRB-

-RRB-

Let

Pc

be

the

probability

that

a

U

lock

converts

to

a

W

lock

Then

W

Pc

U

TnU

be

the

expected

time

to

service

a

U

lock

if

the

lock

does

not

upgrade

to

a

W

lock

TuU

be

the

expected

time

to

service

a

U

lock

if

it

upgrades

to

a

W

lock

Therefore

the

input

parameters

for

the

queue

are

R

U

R

W

Pc

TnU

and

TuU

Since

w

Pc

U

Theorem

gives

the

expected

wait

for

a

W

lock

Theorem

gives

the

expected

wait

for

a

R

lock

All

that

needs

to

be

done

is

to

calculate

the

expected

wait

for

a

U

lock

The

expected

service

time

for

a

single

U

lock

is

U

AU

-LRB-

Pc

-RRB-

TnU

Pc

-LRB-

T

cU

E

-LSB-

Ww

-RSB-

W

-RRB-

-LRB-

Pc

-RRB-

TnU

Pc

-LRB-

T

cU

-LRB-

r

r

-RRB-

r

-RRB-

-LRB-

-RRB-

Therefore

the

utilization

of

the

U

lock

queue

is

aeU

U

U

U

-LRB-

-LRB-

Pc

-RRB-

TnU

Pc

-LRB-

T

cU

-LRB-

r

r

-RRB-

r

-RRB-

-RRB-

If

we

model

the

U

lock

queue

as

a

queue

then

from

-LSB-

-RSB-

Theorem

The

expected

waiting

time

for

a

U

lock

in

the

R/U/W

queue

is

E

-LSB-

WU

-RSB-

-LRB-

aeU

AU

-RRB-

-LRB-

aeU

-RRB-

-LRB-

-RRB-

Since

W

locks

are

generated

from

U

locks

the

throughput

of

the

R/U/W

queue

is

limited

by

the

service

of

the

U

locks

Corollary

The

throughput

of

the

R/U/W

queue

is

limited

by

U

max

-LRB-

-LRB-

Pc

-RRB-

TnU

Pc

-LRB-

T

cU

-LRB-

r

r

-RRB-

r

-RRB-

-RRB-

Comparison

and

Experiments

A

R/U/W

queue

was

built

and

experiments

run

Six

hundred

thousand

samples

were

taken

Table

shows

a

comparison

between

analytical

and

simulator

results

Since

the

one-writer

queue

and

the

R/U/W

queue

are

so

similar

the

comparison

applies

to

the

one-writer

queue

also

The

comparison

shows

that

the

analytical

model

predicts

waiting

times

well

The

accuracy

of

the

analytical

model

improves

as

the

reader

arrival

rate

increases

Conclusions

We

have

developed

a

simple

yet

accurate

model

of

FCFS

reader/writer

queue

performance

We

present

formulae

to

predict

the

shared

resource

capacity

waiting

times

for

read

and

write

locks

and

the

arrival

rates

that

produce

a

desired

system

loading

The

formulae

are

simple

enough

to

be

used

in

a

rule

of

thumb

by

a

system

designer

We

extend

the

analyses

to

handle

one-writer

queues

and

write-upgrade

locks

We

present

formulae

to

predict

lock

waiting

times

and

an

estimate

of

the

capacity

of

the

shared

resource

The

locking

queues

analyzed

in

this

paper

are

used

in

many

areas

such

as

concurrent

data

structures

-LSB-

-RSB-

and

communications

channels

-LSB-

-RSB-

References

-LSB-

-RSB-

F.

Baccelli

C.A.

Courcoubetis

and

M.I.

Reiman

Construction

of

the

stationary

regime

of

queues

with

locking

Stochastic

Processes

and

their

Applications

-LCB-

-LSB-

-RSB-

F.

Baccelli

and

E.G.

Coffman

Jr.

A

data

base

replication

analysis

using

an

M/M/m

queue

with

service

interruptions

SIGMETRICS

Performance

Evaluation

Review

-LRB-

-RRB-

-LCB-

-LSB-

-RSB-

R.

Bayer

and

M.

Schkolnick

Concurrency

of

operations

on

B-trees

Acta

Informatica

-LCB-

-LSB-

-RSB-

P.A.

Bernstein

V.

Hadzilacos

and

N.

Goodman

Concurrency

Control

and

Recovery

in

Database

Systems

Addison-Wesley

-LSB-

-RSB-

T.J.

Bromwich

An

Introduction

to

the

Theory

of

Infinite

Series

MacMillian

and

Co.

-LSB-

-RSB-

A.

Chesnais

E.

Gelenbe

and

I.

Mitrani

On

the

modeling

of

parallel

access

to

shared

data

Communications

of

the

ACM

-LRB-

-RRB-

-LCB-

-LSB-

-RSB-

E.

Coffman

and

et

al.

An

analysis

of

parallel-read

sequential-write

systems

Performance

Evaluation

-LCB-

-LSB-

-RSB-

E.

Coffman

E.

Gelenbe

and

B.

Plateau

Optimization

of

the

number

of

copies

in

a

distributed

database

IEEE

Transactions

on

Software

Engineering

-LRB-

-RRB-

-LCB-

-LSB-

-RSB-

C.A.

Courcoubetis

and

M.I.

Reiman

Optimal

control

of

a

queuing

system

with

simultaneous

service

requirements

IEEE

Transactions

on

Automatic

Control

-LRB-

-RRB-

-LCB-

-LSB-

-RSB-

C.A.

Courcoubetis

M.I.

Reiman

and

B.

Simon

Stability

of

a

queuing

system

with

concurrent

service

and

locking

SIAM

J.

Computing

-LRB-

-RRB-

-LCB-

-LSB-

-RSB-

T.

Johnson

The

Performance

of

Concurrent

Data

Structure

Algorithms

PhD

thesis

NYU

Dept.

of

Computer

Science

-LSB-

-RSB-

T.

Johnson

and

D.

Shasha

A

framework

for

the

performance

analysis

of

concurrent

B-tree

algorithms

In

ACM

SIGACT/SIGMOD/SIGART

Symposium

on

Principles

of

Database

Systems

pages

-LCB-

-LSB-

-RSB-

L.

Kleinrock

Queueing

Systems

volume

John

Wiley

New

York

-LSB-

-RSB-

C.G.

Van

Der

Laan

and

N.M.

Temme

Calculation

of

Special

Functions

The

Gamma

Function

the

Exponential

Integral

and

Error-like

Functions

Cenrtum

foor

Wiskunde

en

Informatica

-LSB-

-RSB-

Ian

Heavens

Spider

Systems

Ltd.

Experiences

in

fine

grain

parallelisation

of

streams-based

communications

drivers

In

OpenForum

Utrecht

November

-LSB-

-RSB-

R.

Mickens

Difference

Equations

Van

Nostrand

Reinhold

New

York

-LSB-

-RSB-

D.

Mitre

and

P.J.

Weinberger

Probabilistic

models

of

database

locking

Solutions

computational

algorithms

and

asymptotics

Journal

of

the

ACM

-LRB-

-RRB-

-LCB-

-LSB-

-RSB-

R.

Nelson

and

B.

Iyer

Analysis

of

a

replicated

database

Performance

Evaluation

-LRB-

-RRB-

-LCB-

-LSB-

-RSB-

M.I.

Reiman

and

P.E.

Wright

The

stability

and

latency

of

concurrent-x

exclusive-y

Submitted

to

the

Journal

of

the

ACM

-LSB-

-RSB-

M.I.

Reiman

and

P.E.

Wright

Performance

analysis

of

concurrent-read

exclusive-write

In

Proc

ACM

Sigmetrics

Conference

on

Measuring

and

Modeling

of

COmputer

SYstems

pages

-LCB-

-LSB-

-RSB-

J.

Riordan

Combinatorial

Identities

Robert

E.

Kreiger

Huntington

NY

-LSB-

-RSB-

G.

Simmons

Differential

Equations

with

Applications

and

Historical

Notes

McGraw-Hill

-LSB-

-RSB-

Y.C.

Tay

R.

Suri

and

N.

Goodman

Locking

performance

in

centralized

databases

ACM

Transactions

on

Database

Systems

-LRB-

-RRB-

-LCB-

-LSB-

-RSB-

A.

Thomasian

and

V.

Nicola

Analysis

of

a

threshold

policy

for

scheduling

readers

and

writers

Technical

Report

RC

IBM

Research

Division

-LSB-

-RSB-

A.

Thomasian

and

V.

Nicola

Analysis

of

a

threshold

policy

for

scheduling

readers

and

writers

In

ACM

SIGMETRICS

Conference

on

Measuring

and

Modeling

of

Computer

Systems

-LSB-

-RSB-

A.

Thomasian

and

V.

Nicola

Performance

evaluation

of

a

threshold

policy

for

scheduling

readers

and

writers

Technical

Report

RC

IBM

Research

Division

to

appear

in

IEEE

Transactions

on

COmputers

Tables

and

Figures

aew

Ww

Wr

r

w

r

w

sim

ana

sim

ana

sim

ana

ru

re

Table

FCFS

R/W

queue

approximation

aew

Ww

Wr

r

w

r

w

sim

ana

sim

ana

sim

ana

Table

FCFS

R/W

queue

approximation

simulation

analytical

r

u

Wr

Ww

Wu

Wr

Ww

Wu

Table

FCFS

R/U/W

queue

r

w

Tn

Tu

Pc

R

W

R

W

R

enters

queue

W

finishes

service

serve

serially

serve

concurrently

W

R

R

W

R

R

W

R

Figure

Model

of

a

FCFS

Reader/Writer

Queue

readers

enter

readers

leave

A

previous

W

enters

B

previous

W

leaves

C

current

W

enters

Figure

Surviving

readers

Writer

wait

-LRB-

ana

-RRB-

Writer

wait

-LRB-

sim

-RRB-

Reader

wait

-LRB-

ana

-RRB-

Reader

wait

-LRB-

sim

-RRB-

Waiting

time

vs.

reader

arrival

rate

waiting

time

reader

arrival

ratereader

arrival

rate

Figure

Comparison

between

analysis

and

simulation

of

R

and

W

waiting

times

w

r

w

analytical

simulation

Writer

utilization

vs.

reader

arrival

rate

utilization

reader

arrival

ratereader

arrival

rate

Figure

Comparison

between

analysis

and

simulation

of

writer

utilization

w

r

w

Maximum

reader

arrival

rate

vs.

writer

arrival

rate

max

reader

arrival

writer

arrival

ratewriter

arrival

rate

Figure

Maximum

reader

arrival

rate

vs.

writer

arrival

rate

r

w

Maximum

writer

arrival

rate

vs.

reader

arrival

rate

max

writer

arrival

reader

arrival

ratereader

arrival

rate

Figure

Maximum

writer

arrival

rate

vs.

reader

arrival

rate

r

w

lock queue
performance analysis
queuing system


A Framework of Secure Object System Architecture Ludovic Rousseau St?ephane Natkin fLudovic.Rousseau,natking@cnam.fr CEDRIC/CNAM , 292 rue Saint Martin , 75141 PARIS Cedex 03 , France June 24 , 1996 Abstract This paper presents some basic principles for the design of secure object oriented operating systems . The security relies on the control of right to call an object method . Distributed capabilities are used to implement the control scheme . Capability implementation , creation and rights propagation are discussed . 1 Introduction This paper presents a general framework of a distributed secure object oriented operating system . An important work has been devoted to the design of distributed systems in the last decade , but in general , either security features are not considered or the kernel of security functions is still centralized . The control of security often uses a central server . It is easier to control and secure a single machine than a set of computers as the distribution of the security controls weakens the protection against intrusions . The Kerberos system -LSB- 7 -RSB- is the result of this paradigm . In counterpart , the Kerberos server must be strongly protected for it contains enough information to impersonate any entity in the system . Moreover the performances and availability of the whole system rely on the access to a single server . This is an important limitation to the advantages of a distributed computer system . Another important issue is the distribution of security responsibilities . The main responsibility in a secure system is to admit new entities and to give them primary rights on resources integration . The security officer paradigm is usually associated with the central server security paradigm . That is to say that all main decisions related to the security authorizations are taken , at a given time , by a single person . Therefore this security officer has to be as available and trustable as the central security server . So the goal of our research work is to study how security functions can be distributed in two ways : ffl distribution of tasks , storage and data management in general according to dependability and performance criteria . ffl distribution of responsibility of rights management that relies on a cooperation between several security officers . This paper focuses only on the first item . We will try to answer the two following questions : 1 . Does the distribution of security objects in a distributed environment allow to obtain a secure distributed environment ? 2 . Which services have to be added to a distributed system to secure it and to provide security services ? We have to define a structure and a set of mechanisms in order to build a security kernel for a dis - tributed object oriented system . This security kernel has to be distributed and minimal . 2 Concepts and terminology This section is devoted to a short presentation of the terminology and the concepts used in the rest of the paper . 2.1 Distributed Object Systems During the last decade , the research on operating systems has been concentrated on distributed operating systems , distributed protocols for elementary actions -LRB- mutual exclusion , control , etc. . . -RRB- , micro kernels , etc. . . and more recently on distributed object management . A distributed object oriented operating system is an operating system in which all the operations performed by a user or a user process are calls to a method of a given object . The localization of the object implementation is transparent to the caller , therefore the call is either local or an RPC -LRB- Remote Procedure Call -RRB- -LSB- 2 -RSB- . Objects are instances of objects classes . A class or an object can be created either by another object or by a human operator . The only method of a class is the creation and the destruction of objects that are the instances of this class . At boot time some initial objects are created : ffl Permanent system classes , which can be called to create a system object ; ffl Permanent system objects . We consider two particular permanent system objects : ffl The class manager , which is used to create and destroy new object classes ; ffl The object manager , which is used to create and destroy new objects . The creator of an object is the owner of this object , until it gives the ownership of this object to another entity or the object is destroyed . 2.1.1 Entities Security relies on authentication of objects to control their actions . Entity is a class of object such that each entity has a unique name and can be authentified as the owner of this name by a secure scheme . Rights which allow a given entity to perform objects methods are dynamically managed by the system . In the following we consider only secure operations . Therefore all objects involved in these operations are entities . 2.1.2 Operators Operators are external to the system and can interact with it . We consider three kinds of operators : 1 . Simple users known by the secure distributed object system ; 2 . Security officers who are in charge of creating the simple users representative entities and give them initial rights ; 3 . Unreferenced operators . It can be either human operator or all possible external phenomenon such as hardware or software failures that can modify the system behavior . Operators are known only by their representative entities . 2.2 Secure Operating Systems 2.2.1 Definition Security of operating systems has been discussed since a long time . A rough definition of a secure operating system is : any entity in the system can perform exactly and only the actions it is allowed to do . Hence security relies essentially on identification and authentication of the entities and the control of the rights to perform a given action . In an object operating system this can be restated as follow : at a given time , each entity has the right to call a set of objects methods . A secure object oriented distributed operating system is such that it is able to manage rights evolution according to a given security policy and to detect and deny any call to an object method that is not explicitly allowed by the caller 's rights . The system must be able to forbid any access to data or programs that are not performed through methods known by the system . It also might be able to detect and log all invalid actions -LRB- audit property -RRB- . 2.2.2 Security kernel and reference monitor A secure system relies on a security kernel -LSB- 11 -RSB- which can be roughly defined as follow : given a set of security properties , no action performed by an operator or an object that is outside the security kernel can violate these properties . The reference monitor is the software implementation of the security kernel . It implements the security mechanisms with the access rules and the access matrix . When an entity requests a method of an object , the reference monitor checks the existing access rights and grants or not the access -LRB- figure 1 -RRB- . The reference monitor has the three following properties -LSB- 15 -RSB- : ffl It must be uncircumventable . The reference RM Access matrix Reference monitor Object 1 Object 2 Figure 1 : Reference monitor monitor must always be called to access a method , when the access rights are limited . The reference monitor is called through a stub . ffl It must be inviolable . No attack against the reference monitor should modify its fonctionnalities . ffl It must be proved correct against its specifications . 3 State of the Art 3.1 Elementary operations The basis operations are : ffl Mutually authenticate the caller and callee objects . This is realized with cryptographic protocols -LSB- 12 -RSB- . ffl Control the rights of the caller to execute the method , and then manage information structures defining the right relations entity ? object . There exists two kinds of structures : access control lists -LRB- ACLs -RRB- and capabilities -LSB- 6 -RSB- . ffl Garantee the integrity , and possibly the confidentiality , of the messages . This is based upon integrity and confidentiality protocols -LSB- 12 -RSB- . ffl Log the transactions . 3.2 Rights and the access matrix The access matrix contains all the rights of each entity on each object . It can be splitted by raw or by columns that leads either to capabilities or Access Control Lists . These two methods have pros and cons relatively to two problems : propagation and revocation of rights . 3.2.1 Right propagation The right propagation is the transmission by an entity of one of its right to another entity . Using capabilities , an entity has just to send its capability to propagate its right . The object needs not to be informed of the propagation . Using access control lists , the entity has to ask the object to add an entry in its ACL . This clearly is a drawback in distributed systems , for the current availability and location of the object may be unknown by the right owner . 3.2.2 Right revocation The well known advantage of ACL is the simplicity of rights revocation . A revocation is just a change in the object control access list . For capabilities , the revocation is much more complex . The locations of the capabilities must first be found . For a transitive propagation scheme , they may be many owners of the right that has to be revoked , and the propagation tree must be constructed . At last , since capabilities are only represented by software data , hidden copies of the capability may be created and replayed after the corresponding right revocation . Therefore the advantage is here to ACL . We will discuss the problem of revocation in section 4.6.5 . 3.3 Capabilities in existing systems Encrypted signature capabilities were defined by Gligor and Lindsay -LSB- 5 -RSB- and are used to forbid the creation of forged capabilities . In this paper , the DES is used to crypt the capability before the migration through the network . Capabilities could not be forged but they could be replayed once being known . In most existing secure distributed systems proposals -LRB- LLNL -LSB- 16 -RSB- , AMOEBA -LSB- 13 , 14 -RSB- , Password Capabilities -LSB- 1 -RSB- -RRB- , capabilities are signed or encrypted in some way to make them unforgeable . They still need to be kept secret since capabilities in these systems are anonymous . Anyone who get a copy of a capability can use it for its own . We choose to use signed and named capabilities since these capabilities are unforgeable and can be sent en clair over the network and can only be used by their legitimate owners . As a consequence they can not be stolen and need not to be kept secret in a protected part of the system . 4 Principles of the solution This section presents the solution principles . 4.1 Preliminary remarks First , we make some general remarks about security and distributed systems . 4.1.1 Software security The security of a computer system can not rely only on software mechanisms . Even if several layers of software control are used according to the system level -LRB- from application level to kernel level -RRB- , a malicious user with sufficient knowledge of the software can remotely or locally modify the software and bypass the controls . To avoid this kind of attack , the system must be such that the modification of ker - nel level rights and code needs a physical access to the critical part of the system . Then the security policy finally relies on physical and procedural protections that will guarantee that only authorized users will have a physical access to the critical parts of the system . As a consequence we assume in this paper two basic principles : ffl Remote access : All remote accesses to a computer rely on the secure Remote Procedure Call protocol described below . ffl Local protection : The local implementation of the security kernel relies on hardware protection mechanisms able to provide some local security services : Each local object has its own protected domain . The communication between object domains can only be done by call to the reference monitor through the secure RPC scheme . The reference monitor is locally implemented on a well restricted domain which is able to provide : -LCB- Memory integrity The central memory must be protected because it contains the identification of an entity . This information must be trustable so an entity should not be able to modify this data and then impersonate another entity . -LCB- Memory confidentiality The authentication data are stored in memory because they are used for future authentications . The knowledge of an authentication data is sufficient to impersonate an entity . These data must remain secret so the memory must be read protected . -LCB- Integrity and confidentiality of mass memory If a virtual memory is used , the storage media must provide the same services of integrity and confidentiality as the central memory . These properties may be simply implemented by hardware rings of protection , or by protection domain mechanisms and/or cryptographic algorithms -LSB- 8 -RSB- . Unfortunately these well known protection mechanisms are generally not used on personal computers . 4.1.2 Security of transient rights The access right to a method may be either permanent or transient . In the first case the owner of the right is allowed to use it as often as needed and whenever . The management of transient rights , that is to say rights that may be used in a limited period or a limited number of times , is submitted to replay risks . If the right travels through the network , it is possible to make a copy and use the copy again and again . To cope with this problem many secure systems associate rights only to users . An operation can only be performed during a user session , starting with a securely authenticated login . To enhance this basic scheme , and allow a right to survive the user session , two classes of solutions have been proposed : ffl The right has a timely limited validity -LRB- such as in the Kerberos system -LSB- 7 -RSB- -RRB- ; ffl The right may be used only a limited number of times . In both cases , the limit may be stored within the right representation or within the object . These solutions have some serious drawbacks in term of distributed computing . Assume , for example , a user starts a transaction on a distributed database using a two steps commit protocol -LSB- 6 -RSB- . If a computer fails during the second step of the protocol , the transaction will end only after this computer restarts . The date of end can not be precisely defined because it depends of external events . Consider also the case where a user wants to propagate his right to perform an operation to a cyclic pro- cess . The process has to perform the operation until a given condition becomes true -LRB- for example a computer starts -RRB- and not after . Then neither the date of end nor the number of valid retries is initially known . The problem of reusing a right is discussed in the section 4.5.2 . 4.2 Architecture of the secure sys - tem The security in object oriented systems consists in managing the right of an object to call a method knowing the identity of the caller , the callee and the method . The initial owner of rights is a human operator logged to the system . This right is transmitted to its representative entity and possibly propagated to other objects . Therefore a user of the system must be physically authentified before the corresponding entity is created . An essential function of the reference monitor is the user authentication mechanism . To perform a secure call to a method , the following security services must be performed : ffl authenticate the calling entity ; ffl authenticate the callee object ; ffl control the right of the caller to execute the method ; ffl garantee the integrity of the methods ; ffl garantee the integrity and optionally the confidentiality of the messages ; ffl log the request . These operations are executed by security stubs and are described in section 4.4 . The reference monitor has to validate or deny an access to an object method . So it needs to know what are legal calls . A legal call can be performed either by the owner of the object or by an entity that has obtained the right to call the method . The reference monitor need then to know the owner of each object and to be able to authenticate this entity or a right signed by it . That 's why new objects and classes have to be registered by the object manager and the class manager . The -LRB- object , owner -RRB- and -LRB- class , owner -RRB- lists must be trustable . So all operations on those data structures are done by the class manager or the object manager . Each entity has rights represented by capabilities . The choose of capabilities instead of ACL is related to the dynamic of right and entity creations . All operations on ACLs require an access to the corresponding object and a modification of the corresponding data . This seems good solution when these modifications are not frequent . In a more general distributed system , where many users may login or logout at any time creating distributed computation with many levels of right management , the use of ACLs may be cumbersome . Comparing the two approaches in term of basic operations leads to the following conclusions . Entity and original right creation need the same type of computation . Propagation of rights is easier with capabilities . As stated previously , revocation of rights is more complex using capabilities . But a basic security principle is to propagate rights only when it is really needed . In counterpart , once a propagation right has been given it can generally not be revoked . The only exception is when an entity is suspected to violate the security policy . Here a simple revocation scheme is to invalidate the public key of this entity . More complex situations can be handled using limited validity capabilities . The user authentication mechanism , the security stubs , the class manager and the object manager are the main components of the reference monitor . 4.3 Security Services provided by the system The system provides the following services : ffl Dynamic creation and destruction of entities : named classes and named objects ; ffl Authentication of users and security officers , creation of the corresponding entities ; ffl Creation and revocation of capabilities including right propagation management and protection against capabilities replay ; ffl Secure call to objects methods through a secure RPC scheme that realizes : -LCB- Authentication of the caller ; -LCB- Authentication of the callee ; -LCB- Verification of the right ; -LCB- Integrity of the messages ; -LCB- Integrity of the methods ; -LCB- Confidentiality of the messages ; ffl Secure log requests to the security services . 4.4 Design solutions 4.4.1 Authentication The entities use a public key authentication protocol . An entity must then have a public/private key pair . The private keys are not stored on a central server but distributed in each entity . Each time an entity is created the corresponding key pair is created by the local reference monitor . The private key is stored in a protected part of the reference monitor and can only be accessed through it . The public keys are stored in a distributed server protected by an integrity mechanism : the name of the entity and the public key are signed by the creator of the entity . We will not discuss here the distribution scheme of public keys . 4.4.2 Named classes and objects creation The creation -LRB- figure 2 -RRB- and destruction of classes are methods of the class manager . Therefore they are performed through the secure RPC scheme described in section 4.4.4 . Parameters of the owner private key name Class_creation a new entity public key private key name , code capability Class_manager creation of class code public key server public key list of classes Reference monitor Figure 2 : Class creation Class creation method are the name of the class , and the class execution code and data . The name of the class and of its creator are registered in the local reference monitor with possibly a code integrity check not described here . The corresponding secret and public keys are also created and respectively stored in the local reference monitor and the distributed public key server . The return parameters are capabilities , which allow the creator to create and destroy instances of the class , and the right to propagate these rights . Object creation -LRB- figure 3 -RRB- and destruction follow a more complex scheme . The creator calls the corresponding Object creation method through the secure RPC of the object class . The method calls the Object register method of the object manager . The name of the object and of its creator are registered in the local reference monitor with possibly a code integrity check not described here . The corresponding secret and public keys are also created and respectively stored in the local reference monitor and the distributed public key server . The creator gets , as return parameters , the capabilities granting the use of all the object methods , possibly the right to propagate these rights -LRB- for instance , this can be limited when the corresponding class is owned by the system -RRB- . public key capability class object creation creation of object a new entity private key public key private key list of objects name owner Reference monitor Figure 3 : Object creation 4.4.3 Authentication of users and security officers , creation of the corresponding entities . All users are associated to a particular class of entities , corresponding to rights levels according to the security policy -LRB- figure 4 -RRB- . Classes are hierarchically defined . At the top level are security officers classes . Security Officers are the only classes the instance of which is allowed to create users classes . Lower classes inherit only a part of the rights of higher classes . At the lowest level , each class corresponds to a single user . When a user enters the system , a call to the user authentication method is generated . The user must authenticate itself with a given authentication mechanism using any kind of secret or physical characteristic -LRB- ranging from a smartcard to a biometric system -RRB- -LSB- 4 -RSB- . When the personal authentication is successfully performed , an instance of the user class is created . This entity is the only valid representative of the user in the system . When the user logs out of the system the corresponding entity is destroyed . Notice that capabilities associated with the user entity or obtained by other entities by a right propagation issued by the user entity may survive to this destruction . Security officer class Security officer John entity User Group A class class User Ted entity User Ted User Group B class User Bill class User Bill entity Security officer John class Security officer Dan class Figure 4 : User groups 4.4.4 Secure Remote Procedure Call A method call is a remote procedure call . A secure call is described figure 5 . This procedure is used for remote calls and also for local calls because rights have to be controlled for local calls too . The steps 1 , 6 , 8 , 9 , 10 and 11 are the same as in a standard RPC -LSB- 2 -RSB- . There is four new steps concerning authentication -LRB- steps 2 to 4 -RRB- and right control -LRB- step 7 -RRB- . The authentication mechanism uses a public key algorithm and is described in -LSB- 9 -RSB- . The right control is described in section 4.6.3 of the present paper . When an entity A wants to call an object method B , it must : ffl possess the capability containing the right to call the method B ; ffl initialize an RPC request ; ffl authenticate himself to the callee object ; ffl authenticate the callee object to avoid object masquerading ; 4 monitor of B 7 9 8 Capability secret key of B Protected memory monitor of A 2 1 11 Protected memory secret key of A 3 5 6 10 Called object BCalling entity A Figure 5 : Secure call ffl send the capabilities ; ffl send the request parameters ; ffl wait for the results . When an object receives a request , it -LCB- in fact its reference monitor -LCB- does the following operations : ffl authenticate the caller to garantee the association identity -LCB- capability ; ffl authenticate himself to the caller ; ffl get the capabilities ; ffl check if the capabilities are valid for this caller and the method called ; ffl check the limitations of the right if any ; ffl get the parameters ; ffl execute the method ; ffl send the results . 4.5 Implementation of a capability 4.5.1 Principles According to -LSB- 6 -RSB- : a capability is a structure of information representing rights of an entity to call a method of a given object . The capability includes the identity of the calling entity , the identity of the called object and the identity of the called method . It also must contain the identity of the right . If a time limitation mechanism is used , the limitation must be included in the capability . The capability must not be forgeable nor modifiable ; it must then be signed . The capability must contain the signature and the identity of the signer . The called object has to check the capability . The signer must then be known and trusted by this object . The simplest solution is to use the owner of the object as the signer . So a capability C -LRB- A ; B ; M ; d ; S -RRB- contains : ffl the identity A of the owner of the capability ; ffl the identity B of the called object ; ffl the identity M of the called method ; ffl the identity d of the right ; ffl the informations of limitation of the right ; ffl the identity S of the signer ; ffl the signature . 4.5.2 Capability reuse problem An important problem is the limitation of the validity of a capability . As seen previously , the limitation may be in time or in number of use . 4.5.2.1 Limitation of the number of use For a limitation in the number of use , the creator of the capability sets the number of use allowed . When the right is used , the reference moni - 9 tor checks and decrements the number of remaining uses and accept or deny the request . The first problem is the propagation of such a right . An entity should not be able to propagate a total number of use greater than the number it owns . So we need a counter of uses . If the counter is inside the capability , a user can duplicate the capability and double his number of uses . The counter must reside in the called object or more precisely in its reference monitor . The mechanism must garantee that a user with a number n of uses can not use more than n times the method , either directly or by propagation of his right . Each time a transient right capability is created , the localization of the corresponding object must be found . The local reference monitor must then store the counter for each entity . The counter is decremented each time this entity call the method or when an entity call the method with a right propagated from the former entity . The reference monitor checks if each intermediate entity has not yet reached its quota . An entity can then restrict very precisely the rights it propagates . For example , it can give a right for just one use . It also can give more rights than he owns himself . For example , it can split a cake in two parts and give the right to eat a part of cake to three persons . Only the two fastest will have cake . This mechanism has a serious drawback : the reference monitor has to store a counter for each entity able to call an object method . This induced a memory of rights in the object representation and has both disadvantages of capabilities and access control lists . 4.5.2.2 Limitation to a laps of time Here the use of the method is limited to a given period of time . This period is fixed by the creator of the capability and can not be larger than the one the creator received by propagation . It can only be shortened . This limitation is somewhat simple to implement . The creator of the capability and the object must just have the same time reference . The validity criterion is time . This criterion is independent of the objects . The reference monitor does not need more than the local time to validate or not a capability . We must however use a fault tolerant time synchronization mechanism . A malicious user should not be able to delay the clock of the reference monitor to use a capability after its normal period of validity . 4.5.2.3 Limitation to given dates The limitation to a laps of time is hard to calibrate to limit the number of uses . The counters of use limit the number of use but are complex to implement . A solution is to use discrete time to define dates of use . This discrete time can be logic or physic . In the case of a logical time , at the creation of the capability , n ordering numbers are allocated by a distributed counter for the execution of the method . The executions follow this order . This solution does not impose a time constraint but require a distributed management of the counter and a solution of the problem of message lost . If a request is lost , this request will be awaited and the following requests will be delayed forever . In the case of a physical time , the ordering numbers are execution dates . The executions are served at the indicated dates . This solution tolerate the loss of a request but impose a temporal ordering of events in the system and a byzantine fault tolerant clock synchronization protocol . 4.6 Right management protocols The use of rights must be specified . We define the following protocols : ffl rights creation ; ffl rights propagation ; ffl rights use ; ffl propagation of the propagation rights ; ffl rights revocation . 4.6.1 Right creation Only the owner of the object can sign -LCB- and then create -LCB- capabilities for this object . The entity fixes itself the rights it gives to the other entities . Among the rights there is the right to propagate a right . 4.6.2 Right propagation The propagation right allows an entity A with a right received from B to propagate this right to C without contacting B . A creates a capability with the right it propagates to C . This capability must be signed . It is not signed by B to avoid backtracking search in a propagation chain . It must then be signed by A . When C will use this right , it will send the capability chain -LRB- figure 6 -RRB- . E.g. send to the called object the capability that gives A the right to propagate the right and the capability that gives C the right to use the right given by A . A C B A Object Object Method Method RightRight B 's signature A 's signature Figure 6 : Capability chain Formally , the object must verify that it has C -LRB- E1 ; O ; M ; d + pd ; A -RRB- ; : : : ; C -LRB- Ei +1 ; O ; M ; d + pd ; Ei -RRB- ; : : : ; C -LRB- E ; O ; M ; d ; En -RRB- where ffl C -LRB- Y ; O ; M ; d ; X -RRB- is a capability issued by X to Y to call the method M of O with right d. ffl pd is the right to propagate the right d. ffl C -LRB- E1 ; O ; M ; d + pd ; A -RRB- is the capability from A , the owner of the object , to the entity E1 . ffl C -LRB- Ei +1 ; O ; M ; d + pd ; Ei -RRB- ; i 2 f1 ; n ? 1g are intermediate capabilities . ffl C -LRB- E ; O ; M ; d ; En -RRB- is the final capability . 4.6.3 Right use The entity has to provide a valid capability to use the right . A capability is valid if it is signed by the owner of the object or signed by an entity who has the right to propagate the right . The entity provides either a capability signed by the owner of the object or a capability chain . 4.6.4 Propagation of the propagation rights The propagation right is not a normal right . It is a right for another right and not for a method call . It can be considered as a meta-right . There is no propagation right of the propagation right . For each right d -LRB- except the propagation right -RRB- there is : ffl the right himself : d ; ffl the right to propagate the right : pd . An entity Y that owns C -LRB- X ; Y ; d + pd -RRB- a right and the right to propagate it can propagate either the right alone C -LRB- Y ; Z ; d -RRB- or the right and the propagation right C -LRB- Y ; Z ; d + pd -RRB- to the entity Z. 4.6.5 Right revocation Goscinski -LSB- 6 -RSB- presents the main problems and gives some solutions for right revocation protocol . As seen previously in 4.1.2 and 4.5.1 , the revocation should not be frequent . It is the responsibility of the entity to give a limited right if it does n't want to give a permanent and non revocable right . In case of possible attack , the revocation leads to invalidate the public key of the entity whose right is revoked . All of its rights are revoked at the same time but this seems to be reasonable for a possible threat leads to reexamine all the rights of the entity . 4.7 Object migration The reference monitor includes a migration method . When an entity calls this method with the corresponding right , a transfer protocol is initiated between the origin and the destination reference monitors . The exchanged informations are the object , the owner and the private key of this object . The exchange should be made through a secure channel to assure integrity and confidentiality of exchanged data . 4.8 Time synchronization and dis - tributed public key server Due to lack of space , we will not discuss in this paper the Time Synchronization protocol and the Distributed Public Key Server principles . The reader can found details of these aspects in -LSB- 10 -RSB- . This section presents only some elements of the design choices . The distributed clock synchronization algorithm must be resistant to byzantine attacks . The main goal of an attack is to enlarge the precision of the clock synchronization protocol such that it leaves enough time to replay a time limited capability . To do so , the attacker must , roughly speaking , slower the distributed time measurements . To cope with this problem we use an algorithm such that the only possible effect of an attack is to increase the time measurement rate . The well known DHSS -LSB- 3 -RSB- protocol has this property . The public key server is a main part of the proposed solution because it allows the use of a distributed authentication scheme by a distribution of the public keys . This service must be highly available , strongly protected in integrity and provide up to date informations . The server can be either replicated or partitioned over the users computer . In both cases , the most difficult part of the design is the ability to quickly invalidate all copies of a public key . This happens each time a given entity is suspected to be malicious . The solution relies in the use of a broadcast protocol able to tolerate byzantine failures . Several proposals found in the literature are actually compared . 5 Conclusion This paper states some design principles of a distributed secure object oriented operating system . The work presented defines a terminology and fundamental implementation hypothesis . The security kernel relies on a distributed capability protection implemented through a reference monitor . Our research work is now focused on the two other main functions of the security kernel : the clock synchronization protocol and the distributed key server . Another important issue seems to be the distribution of responsibility , which is still an open point . References -LSB- 1 -RSB- M. Anderson , R. D. Pose , and C. S. Wallace . A Password Capability System . The Computer Journal , 29 -LRB- 1 -RRB- :1 -LCB- 8 , 1986 . -LSB- 2 -RSB- Andrew . D. Birrell and B.J. Nelson . Implementing Remote Procedure Calls . ACM Transactions on Computer Systems , 2 -LRB- 1 -RRB- :39 -LCB- 59 , 1984 . -LSB- 3 -RSB- D. Dolly , J. Y. Halpern , B. Simons , and R. Strong . Fault-tolerant clock synchronisation . In Third Annual ACM Symposium on Principles of Distributed Computing , pages 89 -LCB- 102 , August 1984 . -LSB- 4 -RSB- G?erard Florin and St?ephane Natkin . La S?ecurit?e . Cours S?ecurit?e ACB2 du Cnam , 1995 . -LSB- 5 -RSB- V. D. Gligor and B. G. Lindsay . Object Migration and Authentication . IEEE Transactions on Software Engineering , 5 -LRB- 6 -RRB- , 1979 . -LSB- 6 -RSB- Andrzek Goscinski . Distributed Operating Systems - The Logical Design . Addison -LCB- Wesley , 1991 . ISBN 0-201-41704-9 . -LSB- 7 -RSB- John T. Kohl and B. Clifford Neuman . The Kerberos Network Authentication Service -LRB- V5 -RRB- . Request For Comments -LRB- RFC -RRB- 1510 , Network Working Group , September 1993 . -LSB- 8 -RSB- H. Levy . Capability-based Computer Systems . Digital Press , 1952 . 220 pages . -LSB- 9 -RSB- Ludovic Rousseau and St?ephane Natkin . ? Etude de l'Architecture d'un Syst?eme S?ecuris?e R?eparti ? a Objets . Technical Report 96 -LCB- 07 , CEDRIC , CNAM , Paris , February 1996 . Disponible sur ftp.cnam.fr / pub/CNAM/cedric / tech reports/RRC-96-07.ps.gz . -LSB- 10 -RSB- Ludovic Rousseau and St?ephane Natkin . Un serveur de cl?es distribu?e . Technical Report 96 -LCB- xx , CEDRIC , CNAM , Paris , June 1996 . ? A para ^ ? tre . -LSB- 11 -RSB- J. Rushby . Kernel for safety . Safe and Secure Computing Systems , Blackwell Scientific Publications , Londres , 1989 . -LSB- 12 -RSB- Bruce Schneier . Cryptographie Appliqu?ee , Protocoles , Algorithmes et Codes Sources en C. International Thomson Publishing , premi?ere edition , 1995 . ISBN 2-84180-000-8 . Publi?e aux ? Etats-Unis par John Wiley & Sons , Inc. sous le titre Applied Cryptography , Protocols , Algorithms , and Source Code in C. -LSB- 13 -RSB- Andrew S. Tanenbaum and S. J. Mullender . The Design of a Capability-Based Distributed Operating System . Technical Report IR -LCB- 88 , Subfaculteit Wiskunde en Informatica Vrije Universiteit , Amsterdam , 1984 . -LSB- 14 -RSB- Andrew S. Tanenbaum and Robbert van Renesse . Distributed Operating Systems . ACM Computing Surveys , 17 -LRB- 4 -RRB- :419 -LCB- 470 , 1985 . -LSB- 15 -RSB- Gilles Trouessin , Jean-Charles Fabre , and Yves Deswarte . Compatibilit?e entre Tol?erance aux Intrusions et Tolerance aux Fautes . Partie I : Sur l' ? etat de l'art en protection , chiffrement et tol?erance aux fautes . Rapport LAAS 89.395 , LAAS -LCB- CNRS , November 1989 . -LSB- 16 -RSB- R. W. Watson . Identifiers -LRB- Naming -RRB- in Distributed Systems . In B. W. Lampson , M. Paul , and H. J. Siegert , editors , Distributed Systems -LCB- Architecture and Implementation . An Advanced Course , number 105 in Lecture Notes in Computer Science , pages 191 -LCB- 210 . SpringerVerlag , 1981 .

O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O

network security
operating systems security