Securing XML data in third-party distribution systems Web-based third-party architectures for data publishing are today receiving growing attention, due to their scalability and the ability to efficiently manage large numbers of users and great amounts of data. A third-party architecture relies on a distinction between the Owner and the Publisher of information. The Owner is the producer of information, whereas Publisher provides data management services and query processing functions for (a portion of) the Owner's information. In such architecture, there are important security concerns especially if we do not want to make any assumption on the trustworthy of the Publishers. Although approaches have been proposed [4, 5] providing partial solutions to this problem, no comprehensive framework has been so far developed able to support all the most important security properties in the presence of an untrusted Publisher. In this paper, we develop an XML-based solution to such problem, which makes use of non-conventional digital signature techniques and queries over encrypted data. Third-party information dissemination represents today an interesting paradigm for data-intensive web-based applications in a large variety of contexts, from grid computing to web services or P2P systems. Relevant applications include large-scale federated Digital Libraries, e-commerce catalogs, e-learning, collaborative applications, content distribution networks. The main idea of thirdparty architectures is that the information Owner outsources all or some portions of its data to one or more Publishers that provide specialized data management services and query processing functions. Such an approach is scalable, results in highly efficient query execution, and reduces the management costs of the Owner.. * The work reported in this paper has been partially supported by the Italian MIUR under the project 'Web-based management and representation of spatial and geographical data'.. Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. To copy otherwise, to republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Clearly, such architecture has challenging security requirements.. Requiring the Publishers to be trusted wrt security properties is not always an appropriate solution in that large web-based systems cannot be easily verified to be trusted and can be easily penetrated. Thus, our goal is to ensure security properties even in the presence of untrusted Publishers.. The main security properties that should be assured are: confidentiality, integrity, and authenticity. Confidentiality has two aspects. The first, that we call confidentiality wrt the user, refers to protecting data against unauthorized accesses by users. The second, that we call confidentiality wrt the Publisher, deals with protecting data from accesses by Publishers. Integrity requires that data contents are not altered during their transmission. 1 Finally, authenticity assures that a user receiving some data can verify that the data have been generated by the Owner and that the Publisher has not modified their contents. To provide strong guarantees about data contents to users, we need to complement the three basic security properties with an additional property that we refer to as completeness. By completeness we mean that the user receiving a portion of data is able to verify whether he/she has received all the information is allowed to see according to the specified access control policies. Although some proposals exist assuring the satisfaction of some of these properties [4, 5] , no comprehensive framework exists able to enforce all such properties.. In this paper, we develop such a comprehensive solution, by focusing our attention on data expressed in XML [10] . Our solution relies on the use of encryption and non-conventional signature techniques. Encryption is used to support confidentiality. The basic idea is that the Publisher does not operate on clear text data, but on an encrypted version. Encryption is driven by the specified access control policies: all data portions to which the same policies apply are encrypted by the Owner with the same key. Then, each user is provided by the Owner with all and only the keys corresponding to the portions of data he/she is allowed to access. Clearly, both users and Publishers must be provided with additional information to make them able to submit and answer queries on encrypted data. Authenticity/integrity requirements cannot be ensured by traditional digital signature techniques. The reason is that since a user may be returned only selected portions of a document, depending on his/her queries and the specified policies, it is not enough that the Owner signs each document it sends to the Publisher. Thus, we propose an alternative solution, based on Merkle hash trees [8] , to generate document signatures.. Finally, completeness is verified through the so-called query template, which consists of the encrypted structure of the original document. We show that, by executing the queries submitted to a Pub-lisher on the query template, a user is able to verify the completeness of the query answer without accessing information he/she is not allowed to see.. Our work has been inspired by the work by Hacigumus et al. [5, 6] , which developed a method for querying encrypted data stored in relational databases. From such work we borrow the method for querying encrypted data, which is based on partitioning the domains of the relation attributes. The same method has been exploited also in the context of XML data in [7] . However, such approaches only consider confidentiality wrt the Publisher, and they do not address the requirement of confidentiality wrt the users, nor authenticity/integrity and completeness. By contrast, in this paper we extend these approaches to data encrypted with different keys, thus providing confidentiality wrt the users. In addition, we consider also all the other security properties. Other related work is by Miklau and Suciu [9] , which proposed a method for a controlled sharing of XML data, dealing only with confidentiality. As in our approach, confidentiality is ensured by the use of cryptographic techniques. However, the main difference with our proposal is that they do not rely on a Publisher for managing data, rather data are simply published on the web in an encrypted form and each user can access the authorized portions, using the keys he/she receives from the data Owner. However, we strongly believe that relying on a data Publisher has many benefits, in terms of efficiency and optimization of resource usage. Indeed, simply publishing the data over the web would make them the target of a huge number of attacks, with many users trying to perform queries over them, and thus consuming a huge amount of computational resources. By contrast, the Publisher can be equipped with sophisticated anti-intrusion tools and techniques avoiding queries floods. Additionally, not relying on a Publisher requires each user be equipped with a query engine able to process queries over encrypted contents.. Merkle hash trees are a well-known mechanism used in several computer areas for certified query processing. For instance, they have been exploited for authenticating XML documents by Devanbu et al. in [4] . However their approach has many differences wrt our proposal. First, it addresses only authenticity, whereas we address all security properties. Moreover, our approach to authenticity verification does not have limitations on the structure of XML documents to which it can be applied, whereas the approach by Devanbu et al. does not handle attributes and it assumes that data contents can be only present in leaf nodes. Another important difference is that we can certify the authenticity for each possible kind of XPath queries, whereas the approach by Devanbu et al. only handles queries returning whole sub-trees. The work reported in this paper builds on a previous paper by us [1] , where we develop the technique for authenticity verification that we use in the current paper. However, the current paper significantly extends our previous work with techniques for confidentiality and completeness enforcement. Moreover, we define also an architecture and related data structures supporting security properties verification.. The remainder of this paper is organized as follows. Next section presents an overview of the proposed framework. Sections 3 and 4 describe authenticity and confidentiality enforcement; Section 5 introduces the XML encoding we propose to represent the needed security information, whereas Section 6 focuses on query processing. Section 7 deals with completeness. Section 8 formally states some properties of the proposed framework, whereas Section 9 concludes the paper. In this paper we have provided a comprehensive framework able to ensure security properties in the context of a third-party architecture. Our approach also includes a suite of strategies for minimizing the overhead due to updates to the policy base or the document source [3] . The strategies are based on incrementally maintaining the document encryption and the related data structures, upon each update operation, without rebuilding them from scratch each time an update occurs. The work reported in this paper can be extended along several directions. First, we would like to complement our framework with privacy enforcement. An implementation of the proposed system is currently underway. Up to now we have completed the modules for authenticity and completeness verification. We plan to develop also the modules for confidentiality enforcement to test the system performance and to assess the overhead due to update management.

O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Architecture and applications of the FingerMouse: a smart stereo camera for wearable computing HCI Abstract In this paper we present a visual input HCI system for wearable computers, the FingerMouse. It is a fully integrated stereo camera and vision processing system, with a specifically designed ASIC performing stereo block matching at 5 Mpixel/s (e.g. QVGA 320 · 240 at 30 fps) and a disparity range of 47, consuming 187 mW (78 mW in the ASIC). It is buttonsized (43 mm · 18 mm) and can be worn on the body, capturing the user's hand and processing in realtime its coordinates as well as a 1-bit image of the hand segmented from the background. Alternatively, the system serves as a smart depth camera, delivering foreground segmentation and tracking, depth maps and standard images, with a processing latency smaller than 1 ms. This paper describes the FingerMouse functionality and its applications, and how the specific architecture outperforms other systems in size, latency and power consumption. As a new generation of computers, wearable computers are worn on the user's body or are even integrated in his textiles. This allows for new application scenarios: the computer becomes a digital assistant helping the user perform certain tasks. The system shall not obstruct the user in any way, his hands should be free. Ideally the digital assistant provides useful information (e.g. via a head-up display, or sound) without requiring explicit user interaction. In many situations though, user input to the system will be necessary. Obviously the classic input devices like a keyboard or a mouse do not fit into the wearable computing scenario. A new class of human-computer interaction (HCI) devices is required.. This paper describes such a new wearable device, the FingerMouse. Its primary use is to capture the movement and shape of the user's hand when moving in front of the device's cameras, enabling him to interact with the wearable computer using his bare hands (hence the name FingerMouse). This, and further applications scenarios are described in Sect. 6 .. The FingerMouse uses two cameras and its own processing power to run vision algorithms, to capture a scene and transmit the following outputs:. 1. Hand shape: the hand shape is computed as a 1-bit bitmap. This bitmap defines the segmentation of pixels in the scene into either hand/foreground or background.. In a more general sense, the FingerMouse is a binary depth sensing camera, classifying pixels into foreground, when they belong to objects with a distance Z 2[Z min , Z max ]. Z min and Z max can be configured to values from Z prox to +¥. Objects closer than the maximal proximity Z prox produce noise. All other pixels are set to the background class (drawn in black in Fig. 1 ). The FingerMouse transmits this image to a (wearable) computer, acting as a segmenting smart camera. On the computer, a higher level algorithm could use this images for further processing (c.f. Sect. 6). 2. Hand movement: the hand position (absolute coordinates) in the captured images is computed. This allows the user to control an X-Y pointer, similar as a PC-mouse does. For more simple interactions, hand movements (up, down, etc.) are also useful, since they do not require visual feedback as a pointer does. 3. Scene depth image (disparity map): instead of the segmented output, the FingerMouse can also deliver a measurement of the depth of all the pixels. The depth information is the raw disparity measurement from a stereo block matching algorithm (SAD result, L fi R or R fi L), described in Sect. 2. 4. Standard images: the images from the system's two cameras can also be read. This allows to combine the foreground segmentation result (''hand shape'' of the scene with standard camera images yielding the same perspective.. The following features characterize the FingerMouse:. 1. Full integration: the embedded system includes all the parts used for image capturing, image processing and power regulation off a battery voltage. It computes the results mentioned above autonomously and transmits them to a (wearable) computer. 2. Real-time operation: as a HCI device, the computation has to be done online. The FingerMouse operates in real-time, processing several frames per second. 3. Low latency/high usability: when using the system with visual feedback (e.g. X-Y pointer on a screen), the user and the machine become a closedloop system. The smaller the tracking latency (or lag) is, the higher the usability. HCI research suggests that values under 50 ms are acceptable and that latency is more important to usability than the measurement accuracy [1, 2]. 4. No calibration: the device immediately works after power-up. This allows it to be turned on shortly (e.g. when user-interaction is needed), and it increases usability because it does not interrupt the user's work flow. 5. High computation performance: the FingerMouse processes images with a throughput of 5-6 Mpixel/s, e.g. 320 · 240 images at 30-37 fps. We developed a specific ASIC for the image computation, which computes at 20-25 G Operations per second (at 80/100 MHz clock rate). 6. Small size: the current implementation is sized 43 mm · 18 mm. 7. Low power: the current implementation consumes less than 200 mW at full operating speed (ASIC 78 mW). This value has to be seen in conjunction with the possibility to switch the system on and off very quickly.. The vision processing applied to the images is described in Sect. 2. The system architecture which enabled the FingerMouse to be built with the features mentioned above is described in Sect. 3. The resulting hardware system is shown in Sect. 4, and its performance compared to other systems in Sect. 5. Finally we present application scenarios for the FingerMouse in Sect. 6. An earlier version of this article was presented at the 19th international conference on architecture of computing systems (ARCS '06) in Frankfurt am Main, Germany [3] . The six described systems perform similar stereo block matching than the FingerMouse, and could also be used for foreground segmentation. Since their original task is to deliver depth maps, the systems have been optimized for depth output quality, while the refinements in the FingerMouse are more focused on the segmentation of a hand. The software based PC solutions offer a higher level of flexibility in system design and implementation. The image throughput performance of the PC solutions is equalling the FingerMouse, when using today's stateof-the-art desktop or notebook processors.. Their disadvantages are:. • Higher latency: the images have to be transmitted from the cameras first, passing through an interface chip, a driver software and a video API. The full image has to be stored in RAM before an optimized algorithm can process it. Due to the algorithmic complexity, the latency is not deterministic any more. While latencies over 100 ms are tolerable for some applications, they decrease usability in human-computer interaction with real-time visual interaction (like moving a mouse pointer on a screen).. • Little mobility: a notebook solution is somehow portable, but truly mobile platforms like wearable computers (e.g. the QBIC [27] ) remain a few years behind when it comes to processing speed, due to their lower power budgets.. • Less power efficiency: the general purpose architecture of the computers results in a lower processing efficiency (throughput/energy consumption). Additionally, the vision processing has to share the cpu performance with other applications running concurrently.. The other embedded implementations also achieve low latencies, but the FingerMouse has the advantage of its tightly coupled parallel computation and memory architecture inside the ASIC, and thus performs better.. Although the described systems are far from identical, the numbers should give an impression of the performance of the FingerMouse compared to other systems:. The FingerMouse outperforms its competitors on the performance/power ratio, the latency, total system power consumption and size. The FingerMouse falls back when it comes to flexibility and depth map quality (depth maps are not used in our application scenarios).

O O O O O O O O O O O B I B O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Quaternion Zernike moments and their invariants for color image analysis and object recognition Moments and moment invariants have become a powerful tool in pattern recognition and image analysis. Conventional methods to deal with color images are based on RGB decomposition or graying, which may lose some significant color information. In this paper, by using the algebra of quaternions, we introduce the quaternion Zernike moments (QZMs) to deal with the color images in a holistic manner. It is shown that the QZMs can be obtained from the conventional Zernike moments of each channel. We also provide the theoretical framework to construct a set of combined invariants with respect to rotation, scaling and translation (RST) transformation. Experimental results are provided to illustrate the efficiency of the proposed descriptors. Moment invariants have been extensively used in pattern recognition [1] , [2] , scene matching [3] and object classification [4] owing to their image description capability and invariance property. However, they are mainly used to deal with the binary or gray-scale images. With the development of inexpensive digital camera, nowadays almost all images acquired are chromatic. Generally speaking, there are two approaches that are often used for color image processing. The first one consists of transforming the color image into gray-scale one, which may lose some significant color information. For example, if we use the average of three channels for graying the color image, it is impossible to identify the objects having the same shape but different color (red, green, blue). The second one decomposes the color image into three channels, and then calculates the moment invariants of these three channels separately [5] - [8] . Among the latter, Mindru et al. [5] , [6] proposed the generalized color moments for color images, whose integral function is the product of the powers of the pixel coordinates and those of the intensities for one or more color channels. Based on these moments, they constructed a set of invariants to geometric transformation and photometric changes. Suk and Flusser [7] derived a set of affine geometric invariants for color images, which are based on the product of moments defined for different channels. Specially, they introduced the notion of common centroid for defining the central moments in order to achieve the translation invariance. Both methods are the generalization of conventional geometric moments, the difference between them is that the computation of Mindru's moments may refer to two or three color channels, and that of Suk's moments only relates to one channel. Since the kernel functions of geometric moments are not orthogonal, this may lead to information redundancy and low noise robustness.. The orthogonal Zernike polynomials were first introduced by Zernike in 1934 [9] , Teague used them to define the orthogonal Zernike moments [10] . Since then, the Zernike moments have been applied to a number of computer vision problems [1] , [11] - [18] because they have overall better performance than other moments [19] - [21] . The purpose of this paper is to extend the conventional orthogonal Zernike moments to color image in a holistic manner. To that end, we will use the algebra of quaternions.. In recent years, quaternions have been utilized more and more in color image processing. Let f(x, y) be an RGB image, it can be represented by encoding three channels as a pure quaternion as follows ( , ) . where f R (x, y), f G (x, y) and f B (x, y) represent respectively the red, green and blue channel of the color images, and i, j and k are the complex operators. The main advantage of the use of quaternion-type representation is that a color image can be treated as a vector field [22] . The algebra of quaternions has been exploited in color image processing by Ell and Sangwine [22] - [24] . In 1992, Ell [23] introduced the quaternion Fourier transforms (QFTs) in his Ph. D dissertation. Sangwine [24] then applied them to color image. Since then, the QFTs have been successfully employed in color image registration [25] , [26] , watermarking [27] , [28] , motion estimation [29] and texture analysis [30] . Recently, the use of quaternion-based moment functions to color image has been investigated [31] , [32] . We have introduced the notion of the quaternion Zernike moments (QZMs) and derived a set of invariants with respect to image translation and rotation [31] . By using the quaternion algebra, Guo et al. proposed the quaternion Fourier-Mellin moments (QFMMs) to deal with the color images and constructed a set of invariants to rotation, scale and translation (RST) transformation [32] . However, in both methods, the rotation invariance was achieved by taking the modulus of the quaternion moments, this may lead to two disadvantages: 1) the modulus loses the phase information which may be useful in some applications; 2) the modulus only provides one real-valued invariant.. In this paper, we propose a new approach to construct a set of QZM invariants with respect to RST transformation. The remaining of this paper is organized as follows. In Section 2, we first recall some preliminaries about the quaternions, and then present the definition of the QZMs. In Section 3, we derive a set the moment invariants with respect to RST transformation. Experimental results are provided in Section 4 to illustrate the performance of the proposed descriptors. Section 5 concludes the paper. In this paper, we have extended the conventional Zernike moment defined in gray-scale image to color image using the algebra of quaternions. The moment invariants with respect to RST transformations have been constructed. The advantages of the proposed QZMs and QZMIs over the existing descriptors are as follows: (1) the proposed QZMs are based on the orthogonal Zernike polynomials, thus they are more robust to noise; (2) the quaternion-type representation, treating a color image as a vector field, is used in the definition of moments; (3) the constructed QZMIs are quaternion-valued invariants instead of real-valued invariants, thus they provide more real-valued invariants. The results obtained from both simulation and real data show that the proposed descriptors are more robust to noise and have more discriminative power than the existing methods.. The proof has been completed. 

B O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O B I O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O B O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


A comparative study of collaboration-based reputation models for social recommender systems Abstract Today, people increasingly leverage their online social networks to discover meaningful and relevant information, products and services. Thus, the ability to identify reputable online contacts with whom to interact has become ever more important. In this work we describe a generic approach to modeling user and item reputation in social recommender systems. In particular, we show how the various interactions between producers and consumers of content can be used to create so-called collaboration graphs, from which the reputation of users and items can be derived. We analyze the performance of our reputation models in the context of the HeyStaks social search platform, which is designed to complement mainstream search engines by recommending relevant pages to users based on the past experiences of search communities. By incorporating reputation into the existing HeyStaks recommendation framework, we demonstrate that the relevance of HeyStaks recommendations can be significantly improved based on data recorded during a live-user trial of the system. The ability to assess the reputation of online users is an important research area especially as we come to increasingly rely on social networks and connections for a wide range of tasks, from information finding to e-commerce and communication. The central contribution of this article is a generalized approach to calculating user and item reputation based on the collaboration (implicit or explicit, direct or indirect) that naturally occurs between users in a variety of online tasks and scenarios. Early work on computational reputation systems (Resnick et al. 2000; Shneiderman 2000) asserts that users' past performance in online, interpersonal relationships can provide an indication of the extent to which others in their community trust them, and thus their overall reputation within that community. The reputation models put forward in this article are based on that assertion, leveraging information gained from examining past user collaborations to positively influence interactions in the future. This particular approach calculates reputation by using a collaboration graph as a harness. Past work has examined how a graph can be built using trust information explicitly and directly given by users (Massa and Bhattacharjee 2004; Massa and Avesani 2007; Golbeck 2006; Kuter and Golbeck 2010) . This article explores how a graph can be constructed using collaboration information that may be explicit or implicit, and direct or indirect. From this graph the reputation of the users within it can be calculated. We have shown how this approach can be developed in a social search context, proposed a variety of user and item reputation techniques, and demonstrated its overall effectiveness in the context of a live-user trial.. In this article we have explored different ways to translate user reputation scores into an overall page reputation/relevance score. We have described the results of a comparative evaluation based on real-user data, albeit in a constrained search setting, which highlights the ability of these techniques to improve overall recommendation quality, when combined with the relevance-based recommendation ranking metrics that are currently used by HeyStaks. For example, many of the page reputation models can improve precision in delivering relevant recommendations (compared to the standard HeyStaks benchmark) by over 15 %. Moreover, we have found that by combining our WS user reputation model with an enforcement-based item scoring mechanism based on Hooper's rule for Concurrent Testimony (Shafer 1986) , relative performance improvements of up to 22 % are delivered. We believe that this work lays the groundwork for future research in this area which will focus on scaling-up the role of reputation in online social platforms and refining the combination of reputation and content utility.. Our focus in this work was on the role of reputation during the recommendation process, in order to maximise the relevance of the community recommendations made by HeyStaks. But this is just one use of reputation in a system such as HeyStaks. For example, in many social systems there is the risk that malicious users will attempt to manipulate the outcome of social processes; see relevant work in recommender systems research (Lam and Riedl 2004; Mobasher et al. 2007; O'Mahony et al. 2002) . In HeyStaks, for example, it is possible for malicious users to flood search staks with irrelevant or self-interested results, which could impact recommendation quality. By using reputation to mediate recommendation it will be possible to guard against this; these malicious users will have low reputation scores (assuming their contributions are rarely acted on by other users) and as such, their contributions will be unlikely to appear in future recommendation sessions. Furthermore, reputation can be exposed to users of systems like HeyStaks as an important social signal. For example, although HeyStaks' recommendations are anonymous (so users do not know the source of result recommendations at search time), it may make sense to explain recommendations with reference to the reputation of producers in the future. The results of this user trial clearly show the benefit that comes from integrating reputation information into the HeyStaks recommendation engine. We present our key findings in comparing combinations of user and item models to the HeyStaks baseline over the set of user queries obtained from the user trial:. 1. Generally speaking a number of combinations of user and item reputation models are capable of delivering improvements in precision with respect to the HeyStaks baseline. 2. The precision scores recorded increase with respect to w to a point and typically apex in the w = 0.6-0.8 range. 3. Weighted Sum outperforms other user reputation models, regardless of item reputation model. 4. Hooper is the best performing item reputation model, delivering an average precision increase of 15 % across all user reputation models, relative to standard HeyStaks.. The fact that Hooper and Max are significantly more effective at ranking pages than Median and Harmonic Mean is not surprising. Given a set of producer reputation scores for a candidate recommendation, Hooper and Max tend towards the upper bound of the distribution of scores, whereas median and harmonic mean provide a much more conservative reputation measure. For example, imagine a scenario where two very reputable users produce a result page, then two new users with low reputation select this page and become producers for future recommendations. In this case, it stands to reason that we would want to reward that page with a high score given its two more reputable producers rather than penalize it simply because two new users are also producers. However, Hooper's high performance may be peculiar to this trial due to the nature of the task assigned to participants: as the search task was the same for everyone, users tended to converge on the same pages. This meant that the number of producers of a page grew as the trial wore on. As such, the variation of producer reputation scores for a given page became greater. Hooper and Max still rewarded those pages with high reputation whereas Harmonic Mean penalized them, tending towards the lower bound of the set of scores. Anecdotally we have found that the context-aware nature of HeyStaks results in users converging on pages in staks, even in a real-world setting, and thus we consider that Hooper or Max are the most suitable item reputation models going forward.. Differences between the user reputation models can be explained by examining how each user model scores users after each collaboration event. For example, one user may have contributed a single page to a stak that was recommended to and selected by a high-reputation consumer. In the case of WS the reputation of this consumer is irrelevant from the point of view of updating the producer's reputation. In contrast for PR and both HITS Hubs and Authorities, the reputation of the consumer is taken into consideration when the link between consumer and producer is analyzed. Put simply, a previously low reputation user can gain a high degree of reputation by virtue of one high reputation user selecting that one recommendation. If we are scoring users based on their level of engagement with users on a collaborative platform and to prevent gaming, the degree with which they collaborate with other users should be the primary consideration. Since these criteria are best captured by the WS model, we believe that this model is the most suitable of those considered.. Interestingly Hubs was a good performer, in fact Fig. 17 shows Hubs outperformed both HITS Authorities and PR when coupled with Max, Median and Harmonic Mean item models. In a sense, this finding is counter-intuitive and highlights an interesting property of the HITS algorithm in this context. One might expect, for example, that the Authorities model would outperform Hubs, given that Authorities scores capture the extent to which users are good producers of quality search knowledge (i.e. users whose recommendations are frequently selected by other users), while Hubs captures the extent to which users are good consumers (i.e. users who select, tag, vote, etc. HeyStaks recommendations deriving from the activity of good producers). However, given the manner in which the collaboration graph is constructed (Sect. 3.2), once a user has consumed (selected) a recommended result, then that user is also considered to be a producer of the result in question if it is subsequently recommended by HeyStaks and then selected by other users in the future. Thus, good consumers-who select recommended results from many good producers (i.e. producers with high Authority scores)-serve a "filter" for a broad base of quality search knowledge. Therefore reranking default HeyStaks recommendations using reputation scores from the Hubs model leads to the good recommendation performance observed above. However, as stated previously, a significant limitation of the Hubs model is that it is vulnerable to a simple form of gaming; for example, by adding many results to staks, users can accrue high reputation according to the Hubs model which is clearly not a desirable property from a robustness perspective. In the early days of the web, the proliferation of online content meant it became increasingly difficult for people to distinguish between what content was useful and what was useless or even harmful. The work of Brin and Page (1998) and Kleinberg (1999) was significant in understanding that link connectivity can provide a very useful signal when it comes to the relative importance of web pages. Nowadays mainstream search engine technologies are largely based on this idea of connectivity. Around the same time, the popularity of online marketplaces exploded: Online platforms that allowed business-to-consumer or consumer-to-consumer transactions to take place became a key service provided by the web. Whereas traditionally interaction in business took place face-to-face, sites such as eBay and Amazon began to allow people to interact with each other remotely and even without interacting users knowing each other in the offline world. This presented a problem: How do buyers know which sellers are reliable and which are not? Where Google was effectively differentiating between reliable and unreliable pages, these online marketplaces needed a mechanism that distinguished reliable from unreliable users (Dellarocas 2003) .

O O O O O B O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O B I I O O O O O O O O O O O O O O O O O O O O B I O O O B O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O B O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O B O O O O O O O O B O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O B O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O B O O O O O O O B O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Unitary space-time modulation for multiple-antenna communications in Rayleigh flat fading Motivated by information-theoretic considerations, we propose a signalling scheme, unitary spacetime modulation, for multiple-antenna communication links. This modulation is ideally suited for Rayleigh fast-fading environments, since it does not require the receiver to know or learn the propagation coefficients.Unitary space-time modulation uses constellations of T M space-time signals f `;`= 1; : : : ; Lg, where T represents the coherence interval during which the fading is approximately constant, and M < T is the number of transmitter antennas. The columns of each `a re orthonormal. When the receiver does not know the propagation coefficients, which between pairs of transmitter and receiver antennas are modeled as statistically independent, this modulation performs very well either when the SNR is high or when T M . We design some multiple-antenna signal constellations and simulate their effectiveness as measured by bit error probability with maximum likelihood decoding. We demonstrate that two antennas have a 6 dB diversity gain over one antenna at 15 dB SNR. Fading is traditionally regarded as a nuisance by the designers of wireless communications systems. Its effects are often mitigated by some combination of differential phase modulation, interleaving, or the transmission of pilot or training signals [1] . But, paradoxically, Rayleigh flat fading can be beneficial for a multiple-antenna communication link. It is shown in [6, 19] that, in a Rayleigh flat-fading environment, a link has a theoretical capacity that increases linearly with the smaller of the number of transmitter and receiver antennas, provided that the complex-valued propagation coefficients between all pairs of transmitter and receiver antennas are statistically independent and known to the receiver.. However, learning the fading coefficients becomes increasingly difficult as either the fading rate or number of transmitter antennas increases. In an effort to increase channel capacity or lower error probability, it is accepted practice to increase the number of transmitter antennas (thereby gaining "diversity" [9] , [15] ).. But increasing the number of transmitter antennas increases the required training interval and reduces the available time in which data may be transmitted before the fading coefficients change. At vehicle speeds of 60 miles/hour, a mobile operating at 1.9 GHz has a fading coherence interval of about 3 ms, which for a symbol rate of 30 kHz corresponds to a fresh fade every 50-100 symbol periods. If several training symbols per transmitter antenna are needed, the coefficients for only a few antennas can be learned before a fresh fade occurs. Next-generation cellular systems in Europe will be expected to operate under very fast fading (trains moving at speeds up to 500 km/hr [20] ) and hence it may be impractical to learn even the single coefficient between one transmitter and one receiver antenna.. Motivated by these considerations, we used Shannon theory in [8] to analyze multiple-antenna links without imposing any training schemes and with no assumed knowledge of the random fading coefficients.. The complex fading coefficients between all pairs of transmitter and receiver antennas were modelled as independent with uniformly distributed phases and Rayleigh distributed magnitudes. The fading coefficients were piecewise constant over fixed time intervals, with channel coding performed over many such independent fading intervals. We showed that the channel capacity could not be increased by making the number of transmit antennas greater than the length of the fading interval, and found that the capacity-attaining signals had considerable structure. However, we did not explicitly address the problems of modulation and channel coding. In this paper, we use the structure derived in [8] to motivate a particular space-time modulation scheme.. The information-theoretic results in [8] suggest a signal constellation comprising complex-valued sig-nals that are orthonormal with respect to time among the transmitter antennas. We call this signalling scheme unitary space-time modulation. When viewed as vector functions of time, the signals carry the message information entirely in their directions. In this paper, we explain in detail how to create, modulate, and demodulate unitary space-time modulation on a multiple antenna link operating in Rayleigh flat fading.. Throughout most of the paper the propagation coefficients are assumed to be unknown to the receiver, but we also show how to use the modulation when the coefficients are known. When the receiver does not know the coefficients, no attempt to learn them is made. We concentrate on modulation and constellation design, and do not address coding issues that lower error probability by adding redundancy. We focus, instead, on raw or uncoded signal and bit error probabilities. When combined with appropriate channel coding, our proposed signal constellations can theoretically attain a high fraction of the channel capacity. Some multiple-antenna coding issues for receivers that know the channel appear in [18] . Section 2 presents the signal model and operating assumptions, and Section 3 reviews the informationtheoretic foundations for unitary space-time modulation. In Section 4, we extend the information-theoretic justification by arguing that unitary space-time modulation is nearly optimal when the signal-to-noise ratio is high. In Section 5, we consider the use of unitary space-time modulation to transmit data across a multipleantenna link, and discuss maximum likelihood demodulation and the properties a good constellation should have. In Section 6 some signal design issues are treated and simulations of a two-transmitter-antenna system are presented. We extend some of the piecewise-constant theory to continuous fading in Section 7.. The following notation is used throughout the paper: log x is the base-two logarithm of x, while ln x is base e. Given a sequence b 1 ; b 2 ; : : : ; of positive real numbers, we say that a n = O(b n ) as n ! 1 if ja n j=b n is bounded by some positive constant for sufficiently large n; we say that a n = o(b n ) if lim n!1 a n =b n = 0. Two complex vectors, a and b, are orthogonal if a y b = 0, where the superscript y denotes "conjugate transpose." The mean-zero, unit-variance, circularly-symmetric, complex Gaussian distribution is denoted CN(0; 1). Multiple element antenna arrays operating in Rayleigh flat fading can potentially sustain enormous data rates with moderate power in a narrow bandwidth. Our approach to this problem began with the premise that nobody knows the propagation coefficients and that the available transmission time should be spent sending message signals rather than training signals. Information-theoretic considerations then led us to unitary space-time modulation. Preliminary results indicate that this modulation can be highly effective, even though the receiver never explicitly learns the propagation coefficients.. We have derived performance criteria for unitary space-time modulation and indicated the properties that a signal constellation with low block probability of error should have. Our particular constellation designs were ad hoc, however, and the problem of how to design constellations systematically that have low probability of error and low demodulation complexity remains open. We have also not considered how to code across more than one block fading interval. Solutions to these problems are especially urgent for large T and high data rates. A Appendix: Asymptotic behavior of C as ! 1. For M = N = 1, we show that the mutual information generated by a given p(v 1 ) can be no more than o(1). larger than (11), the mutual information generated by p(v 1 ) = (v 1 ? p T), as ! 1. We look first at the first term in We analyze I as in the previous manner, and begin with Provided that a 1 ; : : : ; a n are taken from some finite positive interval, the asymptotic expansion (A.27) is uniform, and hence remains valid even if we let n become unbounded (say, as a function of ). As ! 1, the mutual information in (A.27) is therefore maximized by having a 1 ; : : : ; a n ! The probability of error only depends on the singular values, and hence P e = P ej1 = P ej2 . The singular value decomposition implies that = y 2 ? y 1 , or m = y 2 ] mm ? y 1 ] mm , where the columns of each of the bracketed matrices are orthonormal unit vectors. Consequently 0 m 2.

O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


On Transaction Processing with Partial Validation and Timestamp Ordering in Mobile Broadcast Environments Abstract In this paper, we first discussed the issues of transaction processing in broadcast environments.. No one conventional concurrency control protocol fits well in these environments due to a number of constraints in the current technology in wireless communication and mobile computing equipment.. Recent related research on this area is mainly focused on the processing of read-only transactions.. Update mobile transactions are submitted to the server for single round validation. This strategy suffers from several deficiencies such as high overhead, wastage of resources on to-be-restarted transactions, and many unnecessary transaction restarts. These deficiencies are detrimental to the system performance.. To address these deficiencies, we have designed a concurrency control protocol in broadcast environments with three objectives. Firstly, data conflicts should be detected as soon as possible (at the mobile client side) such that both processing and communication resources can be saved. Secondly, more schedules of transaction executions should be allowed to avoid unnecessary transaction aborts and restarts since the cost of transaction restarts in mobile environments is particularly high. Finally, any synchronization or communication among the mobile clients or between the mobile clients and the server should be avoided or minimized due to the asymmetric property in wireless communication.. We have performed a series of extensive simulation experiments to evaluate the performance of the new partial validation with timestamp ordering (PVTO) protocol. The analysis of these simulation results reveals that both partial validation at the mobile clients and dynamic adjustment of timestamp ordering prove to be effective and contribute differently to the performance of the new PVTO protocol. While the partial validation mechanism (PV) helps to detect data conflict at early stage at the mobile client side and therefore saves resources, the dynamic adjustment of timestamp ordering mechanism (TO) helps to eliminate unnecessary transaction restarts. Combining these two mechanisms greatly improves the system performance in terms of various metrics including miss rate and throughput.. A number of areas are worth further investigation as extension of our work. One area is to consider deadlines in making commitment decision in order to further improve the real-time performance.. Another area is the impact of cached copies of data objects at the mobile clients. Caching [11, 23] probably reduces the latency of client transactions by storing a copy or a certain version of hot data objects in the client cache. Without any modification, the proposed protocol can support caching as far as the required information (WTS and RTS) is stored along with each data object to be cached. Moreover, the validation information at the beginning of every broadcast cycle can help to invalidate any stale cached version. The other area is the issue of disconnection where a mobile client voluntarily disconnects a connection with the server. We have briefly mentioned a pessimistic way of handling disconnection with our new protocol in Section 5. We believe that it could be an interesting topic to be investigated further to enhance the system performance. Acharya et al. [1] discussed the tradeoffs between currency of data and performance issues when some of the broadcast data objects are updated by processes running at the server and the clients. Baruah et al. [6, 8] considered the design of broadcast programs with real-time and fault tolerance constraints for broadcast disks whose contents are occasionally updated. However, in all these work, the updates do not have transactional semantics associated with them either at the server or at the clients. The updates are made only by processes running at the server while the processes at the clients are assumed read-only.. Previous work in the Bdisks environment was driven by wireless applications. They are focused on solving the problems associated with the limited number of uplink channels shared amongst a huge number of clients and the problems of voluntary disconnection where a remote client computer system must pre-load its cache before disconnection.. Only limited research work is dealt with transaction processing in the Bdisks environments.. Herman et al. [13] discussed transactional support in the Datacycle architecture in high-speed networks, which is also an asymmetric bandwidth environment. Datacycle efficiently solves the problem of scalability but puts significant constraints on the database size. However, they use serializability as the correctness criterion that may be very expensive to achieve in such environments. In [22] , the authors proposed a weaker correctness criterion to allow non-serializable execution. The weaker correctness criterion allows read-only transactions to read consistent data without synchronization with the server.. However, since the weaker correctness criterion is based on view serializability, they showed that the determination of legality of histories with respect to this consistency requirement is NP-Complete.. Therefore, to ensure the correctness, they needed to broadcast a huge amount of control information, which can be as large as an n x n matrix where n is the number of data objects. Moreover, they used traditional optimistic concurrency control to process the update transactions that may not suit the Bdisks environment.. In [18, 19] , a number of broadcast methods are introduced to guarantee correctness of read-only transactions. The multiversion broadcast approach broadcasts a number of versions for each data item along with the version numbers. In [20] , a number of means for storing versions are proposed. Multiple versions of data gives high flexibility to process read-only transactions, thus minimizing transaction aborts. The performance results show that the overhead of maintaining versions can be justified by increasing concurrency. In the invalidation-only broadcast, a read-only transaction is aborted if any data item that has been read by the read-only transaction was updated at the server. For the conflictserializability method, both the mobile clients and the server have to maintain a copy of the serialization graph for conflict checking.. In this paper, we propose a new approach to processing transactions in the Bdisks environments where the updates can be originated from the clients. In the new protocol, the mobile clients share a part of the validation function with the server and are able to detect data conflicts earlier.. It is more suitable for the Bdisks environments. In our transaction processing framework, while transactions are processed at the server based on the notion of conflict serializability, the clients can determine whether active transactions can proceed or be aborted.

O B I O B I O B I O O O O O O O O O O O O O O B I O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O B I O O O O O O O O O O O B I O O B I O O O O B I O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O


Type-based safe resource deallocation for shared-memory concurrency We propose a type system to guarantee safe resource deallocation for shared-memory concurrent programs by extending the previous type system based on fractional ownerships. Here, safe resource deallocation means that memory cells, locks, or threads are not left allocated when a program terminates. Our framework supports (1) fork/join parallelism, (2) synchronization with locks, and (3) dynamically allocated memory cells and locks. The type system is proved to be sound. We also provide a type inference algorithm for the type system and a prototype implementation of the algorithm. Safe resource deallocation is a crucial matter in programming languages with manual resource (e.g., memory and files) management such as C and C++. Failing to dispose a created resource, or accessing an already disposed resource Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. To copy otherwise, to republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. OOPSLA '12, October 19-26, 2012 could lead to fatal errors 1 . For example, in the C language, a memory leak occurs if a programmer forgets to deallocate a memory cell allocated by malloc. In order to address this problem, various formal verification methodologies [8, 13, 14, 16, 18] have been proposed. Most of them are, however, for sequential programs.. Our goal is to establish a technique to statically check safe resource deallocation for concurrent programs written in the C language. Not only is it harder to reason about concurrent programs, but also there are more kinds of resources to be considered in concurrent programming languages than sequential languages. For example, IEEE standards describe pthread join(), a function for joining a spawned thread, and pthread mutex destroy(), a function for destroying a mutex, as follows [9] :. The pthread join() . . . should eventually be called for every thread that is created [emphasis added] . . . so that storage associated with the thread may be reclaimed.. The pthread mutex destroy() function shall destroy the mutex object referenced by mutex; the mutex object becomes, in effect, uninitialized. . . . the results of . . . referencing the object after it has been destroyed are undefined [emphasis added].. It shall be safe to destroy an initialized mutex that is unlocked. Attempting to destroy a locked mutex results in undefined behavior [emphasis added].. As a first step towards our goal, we will investigate three basic types of resources-memory cells, locks, and threads-in this paper, though there are other kinds of resources than threads and locks (e.g., barriers and reader/writer locks). The following example written in a C-like language describes the language features we will deal with. Figure 1 allocates two memory cells on heap, sets the pointers to the cells to p and 1 Some of the modern operating systems automatically reclaim resources that have not been not deallocated appropriately. However, we believe that safe resource deallocation is an important issue because not all operating systems have such advanced feature. main() { loop(p, q, l) { p = malloc(); n = 10; q = malloc(); while (n > 0) { l = newlock(); acquire(l); child = *p = 0; fork(loop(p,q,l)); release(l); loop(p, q, l); printf("*q=%d",*q); wait(child); --n; freelock(l); } free(p); } free(q); } Figure 1 . An example of shared-memory concurrent programs. We have proposed a type system based on fractional ownerships to guarantee safe resource deallocation and racefreedom in a low-level concurrent language. The type sys-tem is a non-trivial extension of the previous type system by Suenaga and Kobayashi [13] . The key ideas of the extension are (1) to assign ownerships not only to reference types but also to lock and thread ID types, and (2) to assign procurable type environments to lock types and thread ID types to describe the amount of ownerships granted by or required for operating values of those types. We have also proposed a type inference algorithm for the type system. The algorithm reduces a type inference problem into satisfiability of a system of linear inequalities, which is checked by the SMT solver Z3.. Incorporating more "real-world" features to our framework is another important future direction. For example, we need to add C-like structures to our framework so that programmers can use data structures. This extension could be done as that in the first author's previous work [13] . Extension with pointers to locks is also necessary for dealing with real-world programs. After completing these extensions, we plan to extend FreeSafeTy, the prototype verifier implemented in the previous work [13] , and conduct feasibility study by experiment to observe the scalability of our technique and how much manual insertion of must-alias annotations is needed in reality.. The following program, which is considered to be safe in our semantics and also typechecks in our type system, suggests another direction to be pursued: let x = newlock() in acq(x); let y = fork(rel(x)) in wait(y); freelock(x).. This program is defined to be erroneous in many thread libraries including pthreads because the thread that acquires a lock is different from one that releases the lock. Extending our framework to exclude more of such bad behaviors that consist in real-world software is an important task. In the current paper, the type system excludes all the racy programs. However, in reality, it is sometimes convenient to allow some memory cells to be accessed in a racy manner. Allowing such partially racy programs would be another interesting future work. Terauchi [15] has proposed a type-based race-freedom analysis based on fractional capabilities. His type system assigns a fractional permission to each abstract location. Fractional permissions describe read/write permission to each abstract location. In order to deal with lock-based synchronization and fork/join concurrency, his type system associates what we could call "procurable capabilities" with lock types and thread ID types; each lock type comes with capabilities granted by acquiring/releasing the locks and each thread ID type comes with ones granted by waiting the threads. He also reported the result of experiment. Our idea of procurable type environments is inspired by his type system. An important difference, however, is that our ownerships also represent obligation to be fulfilled (e.g., every lock to be deallocated exactly once before termination), not only capability. This leads to the difference in the typing rules for deallocation of resources; his type system does not exclude programs that deallocate locks twice or more.. Besides Terauchi's work [15] , the idea of using rational numbers for representing ownerships has been used in the area of program analysis [3, 8, 13, 17] . Among them, the work by Suenaga and Kobayashi [13] and that by Heine and Lam [8] deal with safe memory deallocation. However, they only deal with sequential programs. Extension of the previous techniques, especially one proposed in [13] , to concurrency is not trivial: it requires, for example, the acyclicity condition in T-CONFIG, which is not necessary in the sequential setting. Type inference, as we have shown, is nontrivial either due to the presence of procurable type environments.. Gotsman et al. [6] have proposed an extension of the concurrent separation logic [10] with dynamic creation/disposal of locks and threads. Though their work does not deal with safe resource deallocation, it seems that it is not difficult to adapt their framework to do so. They can treat programs that store locks and thread IDs to heap, which is currently not allowed in our framework. They also support structures which, for example, enable a program to create a pair of a memory cell and a lock guarding the cell. We would need to incorporate dependent pairs to the type system in order to deal with such structures. As far as we know, they have not proposed an automated verification based on their framework yet. It seems that their framework requires for spawned threads to terminate with empty ownerships to locks, while ours allow threads to leave release/lock ownerships.. Calcagno et al. [4] have proposed an automated verification technique for concurrent programs. They use biabduction to infer resource invariant, a separation logic formula that describes which part of memory is protected by conditional variables. Our procurable type environments correspond to their resource invariant. The expressiveness of concurrent separation logic allows resource invariant to express more properties than ours (e.g., a pointer not being null). Their work has not been extended with dynamic creation of threads nor conditional variables.. Haack et al. [7] have designed a variant of the concurrent separation logic for multithreaded Java programs. Their framework supports fork/join parallelism and re-entrant monitors. They use fractional permissions to express sharing of a location among several threads. However, it is not clear whether their logic can be easily adapted also for safe resource deallocation because it is based on the intuitionistic version of separation logic. Because intuitionistic separation logic admits weakening, their logic would allow facts about the existence of an allocated memory cell to be freely discarded.. Bornat et al. [2] have extended separation logic to concurrency. They use fractional permissions in their assertion language to express sharing of locations among threads. They also support synchronization with conditional variables by which the logic grants access right to critical regions. This feature is comparable to our procurable type environments in the sense that a resource for synchronization (conditional variables, in their case) is associated with some (fixed) permissions to access guarded resources. However, they do not support dynamic creation of threads. We have implemented an automated verifier based on the algorithm described in this section. The frontend of the verifier that is in charge of C and R is implemented with OCaml. As a linear-inequality solver, we use SMT solver Z3 [5] . The Web interface is available at http://www.fos.kuis. kyoto-u.ac.jp/~rfukuda/freesafety-con/.

O B I I O B I O O O O O O O B I I O O O O O O O O O O O O B I O B I I O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O B I O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O