Middleware for smart gateways connecting sensornets to the internet There is an increasing trend to integrate sensor networks into the Internet, eventually resulting in an Internet of Things. Recent efforts of porting IPv6 to sensor networks turn sensor nodes into equitable Internet peers and RESTful Web Services on sensor nodes allow a distribution of the application logic among sensor nodes and more powerful Internet nodes. The touching point between a sensor network and the Internet is the gateway which translates between the link-layer protocols used in the Internet (Ethernet, Wi-Fi) and sensor networks (IEEE 802.15.4). So far, the functionality of those gateways was fixed and simple. We propose to turn these gateways into smart gateways by enabling them to execute application code. As only the gateway has full knowledge of and control over both the sensor network and the Internet, smart gateways can act as performance-enhancing proxies and intelligent caches to preserve the limited resources of the sensor network. Also, the smart gateway can perform application-specific protocol conversion between highly optimized but non-standard protocols in the sensor network and standardized, but less efficient protocols in the Internet. In this paper we present the design of a middleware for smart gateways that allows the execution of application code on the gateway by offering simplified interfaces to the sensor network and the Internet. We also report preliminary performance results for key functions of the middleware. There is an increasing trend to integrate sensor networks with the Internet. The term Internet of Things has been coined to express the vision of augmenting real-world objects, places, and people with sensors, actuators, and microcontrollers and to connect them to the Internet via wireless communication. Essentially, the Internet of Things offers online access to and control over the state of the real world. One indicator for this ongoing integration of sensor networks and the Internet is the recent trend of porting IPv6 to sensor networks by means of the 6LoWPAN [10] adaptation layer and by using routing protocols such as RPL [14] that have been specifically optimized for resourceconstrained and lossy networks. The touching point between a sensor network and the Internet is a so-called gateway: a computer with two network interfaces that translates between link layer protocols used in the Internet such as Ethernet or Wi-Fi on the one hand, and link layer protocols used in sensor networks such as 802.15.4 on the other hand.. Applications in the Internet of Things are typically distributed over sensor nodes (e.g., data collection, preprocessing, and aggregation) and more powerful Internet nodes (e.g., complex data analysis and decision making). Hence, application-level protocols are also needed that span sensor networks and the Internet to integrate the distributed application logic. A recent trend here is the use of lightweight Web Services based on the REST principle [7] on top of HTTP. The term REST stands for Representational State Transfer. RESTful architectures use the central abstraction of a resource (e.g. aggregated sensor data or a sensor on a sensor node). Resources can have arbitrary representations, e.g. XML, JSON or an application specific binary representation. Every resource is addressed by a URI and can be manipulated (i.e. have its state transferred) using the wellknown HTTP request methods such as GET, POST, PUT, DELETE to retrieve, update, create or delete it. Sensor nodes then would directly support these light-weight Web Service protocols, thereby allowing the application to easily span over the sensor network and the Internet.. We propose to extend this model by allowing the execution of application-specific code on the gateway, such that parts of the application logic execute on sensor nodes, parts on the gateway, and parts on powerful Internet nodes. This proposal is in contrast to the current understanding of a gateway, which is usually responsible for a fixed set of jobs such as to monitor traffic, firewalling, access control and security applications.. This proposal is motivated by the fact that the gateway is in the unique position to participate both in the sensor network and in the Internet, that is, application logic executing on the gateway can exploit knowledge of and information collected from those two networks. Application logic executing on sensor nodes or on Internet nodes does not have access to this combined information.. More concretely, the application code on the gateway can contribute to saving resources in the sensor network. One way to achieve this is by means of protocol conversion. Instead of supporting costly HTTP and REST on sensor nodes, a more efficient protocol such as the Constrained Application Protocol (CoAP) [11] could be used in the sensor network and the gateway would translate between CoAP on the sensor network side and HTTP+REST on the Internet side. Protocols such as CoAP are currently not yet fully standardized and drafts change frequently. Being able to deploy application-specific code on the gateway, one can easily change the protocol in the sensor network without affecting the interface offered to the Internet. Further, the gateway can act as a performance-enhancing proxy (PEP) by answering application requests to the sensor network without communication with the sensor network. By overhearing broadcast messages in the sensor network, the PEP could learn the state of the sensor network in an application-specific way and answer requests from Internet nodes without additional communication with sensor nodes. Finally, the combined information available at the gateway is often helpful in debugging.. To facilitate the development of application code for the gateway, we develop a middleware that offers simplified interfaces to the two networks connecting to the gateway. The architecture of this middleware and its individual components are described in the subsequent section. After that follows a preliminary evaluation of key functions of the middleware. Figure 1 depicts the network architecture and the composition of the smart gateway middleware. Let us first focus on the network architecture. Sensor networks connect through a smart gateway to the Internet and there is one smart gateway for each sensor network. However, besides those wireless sensors, many sensors such as Webcams are directly connected to Internet nodes already today. Our goal is to offer a consistent interface to these two classes of sensors. Hence, we provide so-called virtual sensor nodes that mimic real sensor nodes to which individual sensors are attached. Those virtual sensor nodes are "connected" to the Internet through a smart gateway that is very similar to the smart gateway connecting real sensor nodes. Both smart gateways offer the same interface to application code executing on the gateway. In this paper we have introduced our smart gateway architecture for an integration of WSNs into the Internet. The key idea is to turn the formerly simple protocol translators to smart gateways. These exploit their full knowledge of both the sensor network and the Internet to preserve the limited resources of the sensor network. We presented three differ-ent applications running on top of our smart gateway: protocol translation, request caching, and intelligent caching with sensor discovery. We have evaluated our approach and presented first promising evaluation results showing that smart gateways can speed up response times, reduce the number of messages sent inside the WSN, and thus prolong the lifetime of the WSN.. Future work will include more applications on top, performance optimizations, in-depth evaluations, and integration into our outdoor testbed. Furthermore, we will create new and improve existing prediction techniques for the prediction module. In the end we will build a search engine with different testbeds and virtual sensors connected to proof that our approach is feasible. The overall goal of our research is the seamless integration of (wireless) sensor networks into the Future Internet. By that, we explicitly also focus on higher level integration beyond MAC-or IP-based connectivity.. There has been a lot of research regarding IP connectivity for resource constrained devices that lead to standardization of protocols such RFC 4944 [10] , better known as 6LoW-PAN, that made the utilization of IPv6 in sensor networks feasible. [2] gives a good overview on research in this field in the last years.. Looking at the question of how to integrate the actual data delivered by WSNs into applications in the Future Internet it is easy to argument that a service abstraction, built on standardized protocols, can help managing the complexities and constraints of the scenario. There has been a lot research recently on how to make the currently most popular service middlewares feasible for usage in WSN. Dogan Yazar and Adam Dunkels try to employ standard compliant RESTful HTTP Web Services inside the WSN [15] . For improved performance of the underlying TCP connection they adapt the duty-cycling of the MAClayer protocol to adhere to the session and reliable transport semantics to stay awake for the whole TCP Session. Furthermore, they use the Conditional HTTP GET mechanism to transport only response payload if the ressource has changed since the last request to improve energy efficiency. Glombitza et al. employ SOAP-based Web Services inside the WSN by using the Lean Transport Protocol [8] , an efficient Web Service transport protocol explicitly targeting resource constrained devices. The Internet Engineering Task Force (IETF) has recently started a new working group by the name of Constrained RESTful environments (CoRE) which is currently working on the Constrained Application Protocol (CoAP) [11] that can be used as a middleware to implement RESTful Web Services, based on a compressed subset of HTTP methods and headers, thereby further optimizing payload size. CoAP also tries to implement transport guarantees to make the use of TCP obsolete inside the WSN. In comparison to the aforementioned approaches we try to exploit unused potentials by optimizing the glue line (e.g. the gateway) between the WSN and the Internet. Our goal is to further enhance the overall system efficiency by bridging the gap between the partially contradictory resource requirements and constraints of WSNs and the Internet. Please note that our approach is easily transferable to other middlewares such as SOAP-based Web Services.. The SENSEI EU-FP7 project [12] proposes an architecture that represents sensor nodes as semantic annotated resources that provide services. SENSEI provides means to search and to semantically query for sensor nodes and their data. It makes no assumption about how the services of the sensor nodes are actually provided and is by that compatible with various solutions, such as our RESTful service oriented approach that is transparently performance enhanced.. Sensor Ranking [6] sorts sensors according to the probability that they fulfill a given query. By examining historic data of the sensors for periodicity of measured values, prediction models are generated which try to foresee the currently measured value. The sensors are then contacted in order of decreasing probability. This can eventually reduce the total number of messages needed to find enough sensors that fulfill the given query. Our approach additionally tries to take potential correlations between sensor measurements into account. This allows us to use existing knowledge about sensor output of a node A at a given point in time to improve prediction of the sensor output of a node B if they are correlated.. Global Sensor Networks (GSN) [1] is a middleware that abstracts from the underlying, heterogeneous sensor network technologies, provides efficient distributed query processing and combination of sensor data and dynamic deployment of new sensor nodes and networks. The middleware is dataoriented, providing means to gather, analyze and publish data from sensor networks. Sensor nodes are connected to the GSN via a GSN-specific wrapper. In contrast to GSN our focus lies more on deploying non-proprietary and Internet standards-based middleware such as RESTful Web Services in an efficient manner. This will eventually allow us to use existing data acquisition and mining software built upon standard Internet protocols, alleviating the need for custom-tailored solutions that explicitly target sensor networks. Please also note that by implementing a RESTful HTTP Web Services wrapper for GSN, networks based on our architecture could easily join the GSN network.

O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O B O B I I O O B I O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Taming Hardware Event Samples for Precise and Versatile Feedback Directed Optimizations Abstract-Feedback-directed optimization (FDO) is effective in improving application runtime performance, but has not been widely adopted due to the tedious dual-compilation model, the difficulties in generating representative training data sets, and the high runtime overhead of profile collection. The use of hardware-event sampling overcomes these drawbacks by providing a lightweight approach to collect execution profiles in the production environment, which naturally consumes representative input. Yet, hardware event samples are typically not precise at the instruction or basic-block granularity. These inaccuracies lead to missed performance when compared to instrumentation-based FDO. In this paper, we use Performance Monitoring Unit (PMU)-based sampling to collect the instruction frequency profiles. By collecting profiles using multiple events, and applying heuristics to predict the accuracy, we improve the accuracy of the profile. We also show how emerging techniques can be used to further improve the accuracy of the sample-based profile. Additionally, these emerging techniques are used to collect value profiles, as well as to assist a lightweight interprocedural optimizer. All these profiles are represented in a portable form, thus they can be used across different platforms. We demonstrate that sampling-based FDO can achieve an average of 92 percent of the performance gains obtained using instrumentation-based exact profiles for both SPEC CINT2000 and CINT2006 benchmarks. The overhead of collection is only 0.93 percent on average, while compiler-based instrumentation incurs 2.0-351.5 percent overhead (and 10x overhead on an industrial web search application). M ANY compiler optimizations, such as procedure inlining, instruction scheduling, and register allocation benefit from dynamic information, e.g., basic block frequency and branch taken/not-taken ratios. This information allows a compiler to optimize for the frequent case, rather than using probabilistically estimated frequencies, or assuming that all code is equally likely to execute. Profiling is used to provide this feedback to a compiler.. The traditional approach to profile-guided optimization involves three steps. First, we compile the application with special flags to generate an instrumented version of the program (instrumentation build). Next, we run the instrumented application with training data to collect the profile. Finally, we recompile the application using the profile, which can help the compiler make better optimization decisions (feedback-directed optimization (FDO) build).. Unfortunately, there are four shortcomings in this approach. First, it requires compiling the application twice. For applications with long build times, doubling the build time can significantly degrade programmer productivity.. Second, the instrumentation and optimization builds are tightly coupled, this prevents flexible use of the profile data. For example, GCC requires that both builds use the same inline decisions and similar optimization flags to ensure that the control-flow graph (CFG) profiled in the instrumentation build matches the CFG annotated with the profile data in the FDO build. During the FDO build, profiles are used for inline decisions. However, the compiler cannot find a callsite specific profile to annotate the inlined callees. Instead, it can only use the scaled callee profile to annotate the cloned instances. In addition, GCC requires that the source files remain unchanged between two builds. However, observations indicate that many of the code changes between releases are in the cold paths, and this does not affect the behavior of the hot code. The tight coupling between the two builds prevents the previous profiles from being reused.. Third, collecting profiles requires an appropriate execution environment and representative input. For example, profiling a transaction processing application may require an elaborate database setup and a representative set of queries to exercise the application. Creating such an environment and identifying a set of representative input can be very difficult.. Fourth, the instrumented profile collection run typically incurs significant overhead (reported to range from 9 to 105 percent [5] , [6] , but has been observed to be as much as 10x on an industrial web search application) due to the additional instrumentation code executed. While scaling down inputs may ameliorate the problem, for the profiles to be useful, they must accurately reflect the application's real usage. Crafting an input that is sufficiently scaled down to facilitate fast and easy profiling while retaining high fidelity to the real workload is difficult. The problem is exacerbated by constant application changes potentially making old profiling inputs inapplicable to new versions of the application. Furthermore, the high runtime overhead can alter the critical path of time critical routines, e.g., OS kernel codes, for which getting an instrumentation-based profile is not easily possible in the first place.. These limitations often lead developers to avoid FDO compilation and forgo its associated performance benefits. Several workarounds exist to make instrumentation-based FDO easier to adopt. For example, binary instrumentation can be used to decouple the instrumentation build and the FDO build. However, since its overhead is significantly higher than compiler instrumentation, binary instrumentation is hard to deploy in actual production environments. Synchronous sampling [4] , [24] using instrumentation has been proposed to reduce overhead. However, it needs to insert extra code to switch between the normal and the monitoring states. The inserted code still incurs overhead that is not acceptable for production systems.. To overcome these limitations, we propose skipping the instrumentation step altogether, and rely instead on sampling events generated by the performance monitoring units of modern processors to obtain estimated execution profiles. The sample data do not contain any information about the intermediate representation (IR) used by the compiler. Instead, source position information in the debug section of unstripped binaries is used to correlate the samples to the corresponding basic blocks during the FDO build.. Using sampling to collect profile, together with using source position information to correlate profile has two key benefits. We designed and implemented a framework to use hardware event sampling and source position information to drive feedback-directed optimizations. Both frequency profile and value profile are implemented, making sampling-based FDO achieving good overlap with the true execution frequencies and competitive speedups when compared with the instrumentation-based approach. Moreover, sampling-based FDO provides better portability and usability while incurring negligible overhead. Our experiments show that the proposed techniques are feasible for production use on out-of-order platforms.. Dehao Chen received the BS degree in Huazhong University of Science and Technology, the MS and PhD degrees in Tsinghua University. He is a software engineer at Google. He is working on performance of Google applications, developing scalable mechanisms to make feedback directed optimizations useful in the production environment.. Neil Vachharajani received the BSE degree in electrical engineering, MA degree in computer science, and the PhD degree all from Princeton University, where he was a US National Science Foundation (NSF) graduate fellow. He is a software engineer for Pure Storage where he is working on next generation high performance storage systems. Previously, he was a compiler engineer at Google investigating application performance for warehouse scale computers. His research interests include I/O performance, compiles, computer architecture, and programming languages focused on concurrency and multicore architectures.. Robert Hundt received the Diplom Univ. in computer science from the Technical University in Munich. He is a tech lead at Google. He is working on GMail and data center performance, building fleet-wide in-depth analysis tools, and infrastructure. He is heavily involved in compiler and performance research.. Xinliang Li received the BS and MS degrees (both in EE) from Wuhan University and McMaster University, respectively. He leads the compiler optimizer group in Google. He is working on advanced Profile Directed Optimizations and highly scalable cross module optimizations that can be deployed in Google's build environment.. Stephane Eranian is a software engineer in the Linux kernel team at Google. For several years now, he has been working on improving the Linux kernel support for hardware-based performance monitoring. He is the author of the perfmon2 subsystem. Nowadays, he is a contributor to the perf_event subsystem. Prior to joining Google, Stephane was at HPLabs where he worked on the port of Linux to the Intel Itanium processors. He is the coauthor of the book entitled "IA-64 linux kernel design and implementation." . For more information on this or any other computing topic, please visit our Digital Library at www.computer.org/publications/dlib. As was demonstrated in the performance evaluation, sample FDO shows speedup that is competitive with the instrumentation-based approach. However, these two approaches of collecting profiles are not equivalent. First, instrumentation may insert extra code to collect flexible profiles that is hard to archive by the sampling-based approach. For example, path profiling can be collected using instrumentation. Though LBR can also be used to collect a partial path profile, because of the limited branch entries, it cannot collect the full path profile. Second, sampling the PMU can provide some information that instrumentation cannot get. For example, by sampling cache miss events, sample FDO can derive the locality information and perform aggressive locality optimizations.. In this paper, we focus on traditional profiles that have been adopted by instrumented FDO. The evaluation is also intentionally biased in favor of instrumented FDO by choosing deterministic benchmarks. We leave the study of profiles that sample FDO can use to outperform instrumented FDO for future work. In a recent paper, Levin, Newman, and Haber [17] use sampled profiles of the instruction retirement hardware event to construct edge profiles for feedback-directed optimization in IBM's FDPR-Pro, postlink time optimizer. The samples can be directly correlated with the corresponding basic blocks without using source position information, as this is done postlink time. As is done in this paper, the problem of constructing a full edge profile from basic block sample counts is formalized as a Minimum Cost Circulation problem. In this paper, we extend their work by applying sampling to higher level compilation (as opposed to postlink optimization) and show how sampling additional performance counters can improve the quality of sample profiles.. Others have proposed sampling approaches without relying on performance counters. For example, the Morph system [28] collects profiles via statistical sampling of the program counter on clock interrupts. Alternatively, Conte et al. proposed sampling the contents of the branch-prediction hardware using kernel-mode instructions to infer an edge profile [10] . In particular, the tags and target addresses stored in the branch target buffer (BTB) serve to identify an arc in an application, and the branch history stored by the branch predictor can be used to estimate each edge's weight. Both of these works require additional information to be encoded in the binary to correlate instruction-level samples back to a compiler's IR rather than using source position information present in unstripped binaries. Additionally, neither work investigates the intrinsic bias of the sampling approach nor attempts to correct the collected profiles heuristically.. Other profiling methods build on ideas from both program instrumentation and statistical sampling. For example, Traub, Schechter, and Smith propose periodically inserting instrumentation code to capture a small and fixed number of the branch's executions [25] . A postprocessing step is used to derive traditional edge profiles from the sampled branch biases collected. Their experiments show that the derived profiles show competitive performance gains when compared with using complete edge profiles to drive a superblock scheduler. Rather than dynamically modifying the binary, others have proposed a similar framework that performs code duplication and uses compiler-inserted counter-based sampling to switch between instrumented and noninstrumented code in a controlled, fine-grained manner [16] . Finally, stack sampling has been used, without the use of any instrumentation, to implement a low-overhead call path profiler [14] .. Similarly, there have been proposals that combine instrumentation and hardware performance counters. Ammons, Ball, and Larus proposed instrumenting programs to read hardware performance counters [2] . By selecting where to reset and sample the counters, the authors are able to extract flow and context sensitive profiles. These profiles are not limited to simple frequency profiles. The authors show, for example, how to collect flow sensitive cache miss profiles from an application.. Besides the frequency profiling, instrumentation-based value profiling has been proven to be useful [8] , [15] , and has been adopted in some compilers such as GCC. However, the instrumentation-based approach suffers from excessive overhead and potential inaccuracy introduced by replacement policy. Sampling-based value profiling is proposed to pursue better efficiency and flexibility [7] . However, it still incurs an average overhead of around 10 percent.. Not surprisingly, performance counter sampling has also been used in the context of just-in-time (JIT) compilation. For example, Schneider, Payer, and Gross sample cache miss performance counters to optimize locality in a garbage collected environment [23] . Like our work, the addresses collected during sampling have to be mapped back to the source code (in their case, Java bytecode). However, since their optimizations were implemented in a JIT, they simply augmented the information stored during dynamic compilation to perform the mapping.. Specialized hardware has also been proposed to facilitate PMU-based profiling. ProfileMe was proposed hardware support to allow accurate instruction-level sampling [12] for Alpha processors. AMD adopts the ProfileMe approach in the Opteron processors. As discussed in Section 3.2, it cannot produce profiles accurate enough for compiler use. Merten et al. also propose specialized hardware support for identifying program hot spots [20] . Unfortunately, the hardware they propose is not available in today's commercial processors.. Orthogonal to collecting profiles, recent work has studied the stability and accuracy of hardware performance counters [21] , [26] . In that work, the authors measured the total number of instructions retired across a range of benchmarks on various x86 machines running identical binaries. Their results show that subtle changes to the heap layout, the number of context switches and page faults, and differences in the definition of one instruction can lead to substantial variability in even the total number of instructions retired as reported by the performance counters. Unfortunately, the authors do not study the artifacts in sampling the performance counters, and the results on the aggregate data do not explain the anomalous behavior observed in our experiments.

O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Jug measuring: Algorithms and complexity We study the hardness of the optimal jug measuring problem. By proving tight lower and upper bounds on the minimum number of measuring steps required, we reduce an inapproximable NP-hard problem (i.e., the shortest GCD multiplier problem [G. Havas, J.-P. Seifert, The Complexity of the Extended GCD Problem, in: LNCS, vol. 1672, Springer, 1999]) to it. It follows that the optimal jug measuring problem is NP-hard and so is the problem of approximating the minimum number of measuring steps within a constant factor. Along the way, we give a polynomial-time approximation algorithm with an exponential error based on the well-known LLL basis reduction algorithm. Let α and β be two positive integers. You are given an α-liter jug, a β-liter jug, an unlimited source of water and a drain. You can fill a jug full of water from the source, empty water in a jug into the drain, or pour the water from one jug to another. How do you measure x liters of water? This measuring problem is the so-called water jug problem, which has been studied for a long time and is a popular problem for programming contests, a frequent heuristic search exercise in artificial intelligence and algorithms, etc. The water jug problem has several variants, such as the problem of sharing jugs of wine [5] , i.e., given an x-liter jug full of wine and two empty jugs of capacity α and β where x = α + β, what is the quickest way to divide the wine equally by pouring the wine among the jugs? This problem can be reduced to the water jug problem, since we can replace "pouring from the x-liter jug to any other jug" by the filling operation, and "pouring from any jug to the x-liter jug" by the emptying operation. In [3] , a problem proposed by Ehrlich asks: for two relatively prime integers α and β and an integer m with 1 ≤ m ≤ β, is it possible to measure m liters ? Boldi et al. [4] generalized the water jug problem by considering a set of jugs of fixed capacities and they found out which quantities are measurable and proved upper and lower bounds on the number of steps necessary for measuring a specified amount of water. Here a quantity x is called measurable if after several steps one of the jugs holds the quantity x. In other words, the generalized water jug problem is: given a set of jugs of fixed capacities, find out which quantities are measurable. More specifically, suppose that we are given n jugs with positive integral capacities c i , i ∈ [n], where [n] denotes the set {1, . . . , n}. 1 Without loss of generality, we assume that c 1 ≤ c 2 ≤ · · · ≤ c n . Let x be a positive integer ≤ c n . Boldi et al. proved that x is measurable if and only if it is a multiple of the greatest common divisor of c i 's. Define μ c (x) = min x=x·c x 1 , where x = (x 1 , . . . , x n ) ∈ Z n and x 1 = n i=1 |x i |. They also proved that, for every measurable x, (1) x can be measured in at most 5 2 μ c (x) steps. (2) No algorithm can measure x in less than 1 2 μ c (x) steps. In this paper we deal with the optimal jug measuring problem, which considers the minimum number of measuring steps. We generalize measurability by defining that a quantity x is additively measurable if there is a sequence of operations such that the sum of the final contents in the jugs is equal to x. We prove that x is additively measurable if and only if it is a multiple of the greatest common divisor of c i 's. For every additively measurable integer x, we obtain a lower bound 2μ c (x) − n e , where n e is the number of non-empty jugs. Consequently, we have that: a measurable integer x cannot be measured in less than max{2μ c (x)−n, μ c (x)} steps. Furthermore, all the measurable quantities can be measured in at most 2μ c (x) steps such that the largest jug contains the quantity x and the others are empty. With the tight lower and upper bounds, we can reduce the problem of computing μ c (x) to the optimal jug measuring problem. Meanwhile, Havas and Seifert [6] proved that a special case of computing μ c (x) is inapproximable in polynomial time within a factor of k, where k ≥ 1 is an arbitrary constant. This implies that the optimal jug measuring problem is inapproximable in polynomial time within a constant factor. Moreover, we can reduce the problem of computing μ c (x) to the closest lattice vector problem. Finally, we propose a polynomial-time approximation algorithm with exponential errors for computing μ c (x) based on the famous LLL (Lenstra-Lenstra-Lovasz) basis reduction algorithm.. The rest of the paper is organized as follows. In Section 2, we give some notation and definitions. In Section 3, we characterize additive measurability and prove the lower and upper bounds for the number of non-pour operations. In Section 4, we prove the lower and upper bounds for the number of minimum measuring steps. In Section 5, we show that computing μ c (x) is inapproximable and give a polynomial-time approximation algorithm with exponential errors. Inapproximable results on the jug measuring problem are also addressed. Section 6 concludes the paper.

O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O


Apparent ridges for line drawing Figure 1: The Bust model rendered with several different feature lines. We introduce apparent ridges on the right. They correspond to the maxima of the normal variation with respect to the viewing plane. Note in particular the left side of the face (to the right) in the suggestive contour drawing and the nose drawn with ridges and valleys.Three-dimensional shape can be drawn using a variety of feature lines, but none of the current definitions alone seem to capture all visually-relevant lines. We introduce a new definition of feature lines based on two perceptual observations. First, human perception is sensitive to the variation of shading, and since shape perception is little affected by lighting and reflectance modification, we should focus on normal variation. Second, view-dependent lines better convey smooth surfaces. From this we define view-dependent curvature as the variation of the surface normal with respect to a viewing screen plane, and apparent ridges as the loci of points that maximize a view-dependent curvature. We present a formal definition of apparent ridges and an algorithm to render line drawings of 3D meshes. We show that our apparent ridges encompass or enhance aspects of several other feature lines. Suppose we wish to depict the shape of a rounded cube, which is viewed from a certain direction. One approach is photorealistic rendering. We choose a BRDF and a lighting distribution, and calculate the luminance value that each pixel would have if the real physical object were viewed under those conditions. Figures 2(a) and (b) show two examples, with different choices of BRDF and lighting. Depending on the choices, which are rather arbitrary, the shading and highlights will change. With photorealism there is no way to avoid these arbitrary choices.. An artist will often use a line drawing to convey an object's shape in a manner that is independent of BRDF and lighting. Figure 2(c) shows an example. This image is not photorealistic, since there are no conditions under which the cube's image would actually have these pixel values. Nonetheless the line drawing captures, in a compact and abstract manner, the essential visual properties that are shared by the photorealistic renderings. This image was generated by the method we will describe.. (a) (b) (c) Figure 2 : Depiction of a cube with traditional computer graphics shading and with line drawing (using our apparent ridges).. Line drawing is a popular topic in non-photorealistic rendering (NPR). The key question is: where do you put the lines? Various rules have been proposed. The bounding contour, or silhouette, is obviously important, as are occluding contours that occur within the object. Discontinuities of surface normal, such as those of a cube, produce a ridge line that should certainly be drawn. However, most natural objects contain bumps, dips, and undulations of varying geometry, and it is not clear how these features should be depicted with lines.. A number of approaches have been described. In image-based approaches, the object is rendered to form an image or geometric buffer, and then image processing methods such as edge detection yield an output drawing [Saito and Takahashi 1990; Decaudin 1996; Hertzmann 1999; Pearson and Robinson 1985; Lee et al. 2007 ]. The result is often visually pleasing, but the pixel-based representation suffers from low precision due to the loss of 3D scene information during rendering, and is unsuitable for additional processing. For example, lines can't be rendered with natural brush strokes unless curves are extracted from the edge map.. In object-based approaches, one finds curves that have special properties in terms of the differential geometry of the surface. Several researchers [Koenderink 1990; Ohtake et al. 2004; Interrante et al. 1995] have characterized various such curves, including parabolic lines, which divide hyperbolic from elliptic regions, as well as ridges and valleys, which occur at points of extremal curvature. (Note: in the field of topography, the terms "ridge" and "valley" have a different definition). These curves capture important object properties but do not make natural looking line drawings. They are locked to the object surface, and do not slide along it when the viewpoint changes. As a result, the objects portrayed by ridges and valleys tend to look overly sharp. Given the widely-accepted limitations of object-space ridges and valleys, we believe a major contribution of our work is defining the first successful ridge-like features for NPR.. It is also possible to define curves that have view dependence. The silhouette is one example: it is the loci of points that is only defined with respect to a viewing screen. An important type of view dependent curves, called suggestive contours, has recently been described by DeCarlo et al. [2003; 2004] . Suggestive contours are extensions of occluding contours. They are curves along which the radial curvature is zero. They are locations which are almost contours, and they correspond to true contours in nearby viewpoints.. Suggestive contours capture some, but not all, of the desirable curves that comprise a line drawing. For example, they ignore the dihedrals that define a cube, and will entirely miss the ridge-like features that define the noses in the drawings of Fig. 3 . There is presently no single rule that will generate the full set of desirable lines, so the usual practice is to combine multiple rules.. Our new method gets a rich and comprehensive set of lines with a single rule. This rule is motivated by perceptual considerations. Human observers are highly sensitive to line-like and edge-like features, i.e., points of high luminance variation. A given object, when viewed from a given position, will tend to have such features in a limited set of locations, and these locations tend to be stable across different choices of BRDF and illumination. However, unlike the ridges and valleys of differential geometry, our features are view dependent, which we find is necessary in order to give the line drawing a natural appearance to a human viewer. The lines are drawn at the same places that "line detectors" and "edge detectors" are likely to fire when presented with a rendered image of the same object in the same pose.. Our rule can be succinctly stated as follows: Draw a line when the surface normal is changing at a locally maximal rate with respect to image position. We refer to these lines as "apparent ridges". They depend on the curvature of the object surface as well as the foreshortening that occurs in projection to the viewing plane. Motivation and overview If a line drawing is to be independent of the rendering parameters of BRDF and illumination, then the only remaining local property is the surface normal. This led Felix Klein and after him Hilbert and Cohn-Vossen [1952] and Koenderink [1980] to hypothesize that parabolic lines were of special significance in artist's drawings. However, attempts to leverage this idea have largely failed: parabolic lines do not yield compelling drawings. Likewise, line drawings based on ridges and valleys tend to look "blocky." These drawings look particularly awkward when they are used in animations, as the lines appear to be stuck to the surface, and do not slide naturally over the surface. We believe that the use of strict view independence leads inevitably to this sort of problem.. An alternative approach is to draw lines at locations that are view dependent but are stable across the other rendering conditions. The idea that this might be possible is motivated by the observations of Fleming et al [2004] , who showed that the local orientation structure of rendered objects was similar across multiple choices of BRDF and environment map, and therefore could be used as an invariant description the object's appearance (as seen from a given viewpoint). They hypothesized that the human visual system extracts these invariant properties and uses them to infer the 3-D shape.. Rapid luminance changes occur at points where the angle of the surface normal is changing rapidly. Points in the image with maximal view-dependent curvature (i.e. our apparent ridges) will usually contain maximal luminance gradients. Similarly, Durand et al. [2005] showed that for realistic rendering, such points have highest local frequency content in an image. In computer vision, Yuille [1989] has derived equations in search of photometric invariants that are similar to our lines.. We first describe necessary background differential geometry and introduce the equations for view-dependent curvature and apparent ridges in Section 2. Given the mathematical definition of apparent ridges, we present algorithms to extract them on discrete meshes in Section 3. We show results of apparent ridge line drawings in Section 4. We demonstrate that apparent ridges are useful for conveying shape information and show how they are related to other feature lines.. We develop the equations for view-dependent curvature and apparent ridges. First we review traditional concepts of differential geometry-curvature, ridges, valleys-that are defined from the first and second derivatives of the normal. Then, to define viewdependent curvature and apparent ridges, we calculate the same derivatives with one key change: we derive with respect to a screen plane instead of the surface.

O B O B I O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O B B I O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O B O O O O O O O O O O O B O B O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O B O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O B O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O


Inference in HIV dynamics models via hierarchical likelihood negligible by using a parametric bootstrap procedure. We propose an efficient algorithm for maximizing the h-likelihood. A simulation study, based on a classical HIV dynamical model, confirms the good properties of the MHLE. We apply it to the analysis of a clinical trial. Since the influential paper of Ho et al. (1995) there has been a strong impetus to develop mathematical models for better understanding the interaction between HIV and the immune system; see Nowak and May (2000) .. However the statistical inference in these models has raised major challenges coming from the intrication of identifiability and numerical problems. The first problem is numerical: in general the trajectories of the interesting quantities (e.g. viral load or CD4 counts) are solutions of non-linear differential equations that do not have analytical solutions. The second problem is the identifiability problem: the observations recorded on one subject are not informative enough to estimate all the parameters of the model. The first problem is either avoided, simplifying the models to obtain analytical solutions (Wu and Ding, 1999) , or solved by using numerical solvers of ordinary differential equations (ODE); Ramsay et al. (2007) proposed an original approach but did not apply it to a random effect model. The second problem is partly treated by considering that the particular values of the pa-rameters for each subject are realizations of random variables with a given distribution in the population. This puts the problem in the framework of non-linear mixed effects models. Laplace approximation of the numerical integrals involved in the computation of the likelihood has been proposed (Beal and Sheiner, 1982; Lindstrom and Bates, 1990) ; adaptive Gaussian quadrature is another possibility (see Davidian and Giltinan, 1995) . We refer to Wu (2005) for a review of statistical issues in HIV models. Recently a stochastic approximation EM (SAEM) algorithm has been proposed (Kuhn and Lavielle, 2005; Donnet and Samson, 2007) . In the specific case of HIV dynamics models a Bayesian approach has been proposed by Putter et al. (2002) and Huang, Liu and Wu (2006) , while a special algorithm for computing the likelihood and maximizing using a Newton-like method has been proposed by Guedj, Thiébaut and Commenges (2007) . However all these methods present difficulties and can be time-consuming.. The hierarchical likelihood (h-likelihood) has been proposed for generalized linear models with random effects by Lee and Nelder (1996) and further studied in Lee and Nelder (2001) and Lee, Pawitan and Nelder (2006) and for non-linear mixed effects models by Noh and Lee (2008) . This is very similar to an approach called penalized likelihood used by McGilChrist and Aisbett (1991) and Therneau and Grambsch (2000) for frailty models. The main idea is to treat the random effects (or the frailties) as parameters and to find estimates of all the parameters by maximizing a function which is essentially the loglikelihood conditional on the random effects minus a penalty term which takes large values if the "random" parameters are very dispersed. Penalized likelihood has also been used for function estimation (O'Sullivan; 1988) . The advantage of this approach is that it may avoid computing numerical integrals. The curse of dimensionality is transferred from the dimension of numerical integrals to the dimension of the space on which maximization takes place. There are problems with this approach.. One is the asymptotic distribution of the estimators of the fixed parameters; another is the estimation of the variances of the random parameters.. Consistency of the maximum h-likelihood estimators (MHLE) has not been proved. It is often suggested to revert to the likelihood to have consistent estimators of the fixed parameters, but then the most important benefits of h-likelihood in terms of computational burden is lost. Last but not least is the problem of maximizing a complicated function over several hundred parameters.. The aim of this paper is to develop a (partly non-standard) h-likelihood approach to HIV dynamics models which completely avoids computation of the likelihood. This is in the spirit of penalized likelihood in the sense that we do not try to precisely estimate the variances of the random effects. One aim is to study the asymptotic distribution of the MHLE for a given choice of the penalty. Another aim is to find an efficient maximization algorithm.. The paper is organized as follows. In section 2 we describe a statistical model based on an ODE system in a general form and in a particular form which will be used for simulations. In section 3 we describe h-likelihood and we give the asymptotic distribution of the MHLE for fixed effects when the number of subjects tends toward infinity. We propose a parametric bootstrap procedure to correct the bias of the MHLE. In section 4 we propose a strategy for choosing the penalty based on the guess of an upper bound of the variance of the random effects. An efficient maximization algorithm is presented in section 5. Section 6 presents a simulation study. Section 7 presents the analysis of a clinical trial. We conclude in section 8. We have developed a hierarchical likelihood approach for inference in an HIV dynamical model. We have obtained the asymptotic distribution of the MHLE, we have derived a procedure which makes the bias negligible and we have developed an efficient maximization algorithm. Our simulations show that the whole approach works.. We have shown that it could be applied to the analysis of a real data set. Rather precise estimates of the parameters were obtained. One limitation of this approach is that some parameters must be fixed because of identifiability problems. The model itself, although it is already statistically challenging, may be too simple from a biological point of view. The development of such an approach would require richer data, for instance observing the number of infected T cells.. The main advantage of this approach is that it is easy to implement and very fast as compared to the two main competing approaches, likelihood and Bayesian inference. The main limitation is that it does not attempt to estimate the variances of the random effects. In our application we already have a knowledge of the range of values of these variances. Thus the method can be used for exploring possible models while likelihood or Bayesian inference can be used when estimates of the variances of the random effects are needed.

O O B I I O O O O O O O O O O O O O O B O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O B I I O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


A

semantic-based

mobile

registry

for

dynamic

RFID-based

logistics

support

In

this

paper

we

propose

an

extended

version

of

the

open

source

jUDDI

implementation

by

the

Apache

Software

Foundation,

adapted

to

pervasive

RFID

contexts.

The

registry

adopts

an

OWL-S

Profile

instance

annotation

of

mobile

services

and

resources.

Ontology-based

metadata

are

exploited

in

order

to

perform

a

semantic-based

service

discovery

w.r.t.

a

given

request.

The

proposed

framework

has

been

devised

for

pervasive

RFID-based

logistics

environments.

A

case

study

is

presented

along

with

experimental

results

on

a

prototype

implementation.

Pervasive

computing

is

aimed

to

build

a

model

of

humancomputer

interaction

where

information

as

well

as

computational

capabilities

are

deeply

"integrated"

into

the

environment,

i.e.,

into

everyday

objects

and/or

actions.

The

goal

is

to

reduce

the

amount

of

user

effort

and

attention

required

in

order

to

benefit

from

computing

systems..

Permission

to

make

digital

or

hard

copies

of

all

or

part

of

this

work

for

personal

or

classroom

use

is

granted

without

fee

provided

that

copies

are

not

made

or

distributed

for

profit

or

commercial

advantage

and

that

copies

bear

this

notice

and

the

full

citation

on

the

first

page.

To

copy

otherwise,

to

republish,

to

post

on

servers

or

to

redistribute

to

lists,

requires

prior

specific

permission

and/or

a

fee.

The

"pervasiveness"

refers

to

manifold

aspects

involving

information

storage,

processing

and

discovery.

As

opposed

to

classical

paradigms

(where

a

single

user

explicitly

engages

a

single

device

to

perform

a

specific

task)

exploiting

pervasive

computing

features

the

user

will

interact

with

many

computational

devices

simultaneously.

She

extracts

data

from

the

objects

permeating

the

environment

during

ordinary

activities,

even

not

necessarily

being

aware

of

what

is

happening.

If

"knowledge"

is

embedded

into

semanticenhanced

EPCglobal

RFID

tags

populating

a

smart

environment,

discovery

and

reasoning

tasks

can

be

performed

either

by

hosts

in

the

local

Mobile

Ad-hoc

NETwork

(MANET)

or

by

a

remote

entity

through

a

gateway

exposing

a

highlevel

interface

(e.g.,

Web

Sevices

of

RPC

or

REST

type)

deriving

inferred

relationships

starting

from

explicit

resource

annotations..

In

a

previous

work

we

devised

solutions

for

the

integration

of

semantic-enhanced

EPCglobal

RFID

into

MANETs.

Nevertheless,

we

exploited

a

central

component

for

reasoning

over

a

Knowledge

Base

(KB).

The

reasoning

engine

required

too

large

computational

capabilities

to

be

hosted

by

a

mobile

device.

It

ran

on

a

fixed

server

and

it

was

therefore

a

single

point

of

failure.

That

approach

enabled

objects

equipped

with

RFID

tags

to

describe

themselves

w.r.t.

"rest

of

the

world"

in

a

self-contained

fashion.

But,

in

spite

of

a

strong

decentralization

of

factual

knowledge

(thanks

to

the

storage

of

individual

annotations

in

the

RFID

tag

memory

banks),

reasoning

services

were

provided

only

by

fixed

servers

reachable

via

Bluetooth..

In

this

contribution

we

show

how

the

pervasiveness

of

the

system

can

be

enhanced

if

a

fully

decentralized

and

distributed

approach

is

followed.

In

particular

we

introduce

a

mobile

service

registry

to

carry

out

advanced

matchmaking

using

metadata

stored

in

RFIDs

without

any

central

and

fixed

reasoning

engine.

RFID

readers

are

adopted

as

semantic-based

field

data

collectors

w.r.t.

tags

in

their

radio

range

and

they

are

able

to

automatically

perform

a

service

discovery

without

wired

intermediaries..

Knowledge

Representation

techniques

and

approaches

are

here

exploited

and

adapted

to

volatile

ubiquitous

computing

scenarios.

Building

on

previous

works

that

enhanced

the

basic

discovery

features

of

jUDDI

with

semantic-based

capabilities

in

this

paper

we

propose

an

extended

version

of

the

open

source

jUDDI

implementation

by

the

Apache

Software

Foundation

to

pervasive

RFID

contexts.

The

registry

adopts

an

OWL-S

Profile

instance

annotation

of

mobile

services

and

resources.

Ontology-based

metadata

are

exploited

in

order

to

perform

a

semantic-based

discovery

of

advanced

services

w.r.t.

a

given

request..

The

proposed

approach

has

been

implemented

in

the

framework

of

an

RFID-based

logistics

environment.

The

registry

exploits

an

m-DBMS,

i.e.,

Oracle

Lite

In

order

to

minimize

computational

requirements

due

to

the

full

expressiveness

of

OWL

DL:

we

selected

a

subset

of

OWL

DL

as

reference

logic

formalism;

we

make

more

elementary

allowed

ontology

structures.

Thanks

to

the

simplification

of

ontologies

and

class

descriptions,

standard

reasoning

tasks

(i.e.,

subsumption

and

consistency

check)

can

be

reduced

to

set

comparison,

so

basically

downsizing

the

computational

demand..

These

design

choices

provide

flexibility

in

architecture

adaptation

to

specific

application

requirements.

Moreover,

reuse

of

Semantic

Web

standards

can

simplify

the

integration

of

the

proposed

framework

in

larger

information

infrastructures.

In

what

follows

both

implementation

details

and

experimental

results

are

presented..

The

remaining

of

the

paper

is

structured

as

follows.

Section

outlines

motivation

of

the

proposed

approach

and

Section

presents

the

state

of

the

art

in

the

field

of

service

discovery

in

pervasive

environments.

Section

describes

the

proposed

architecture

and

algorithms,

together

with

their

integration

in

the

OWL-S

framework.

Section

reports

a

case

study

which

illustrates

the

approach

so

better

explaining

the

rationale

behind

it.

Section

outlines

system

implementation

and

obtained

experimental

results.

Conclusions

close

the

paper.

Building

on

our

previous

work,

we

have

presented

a

crossprotocol

approach

to

carry

out

advanced

service/resource

discovery

exploiting

semantic

metadata

stored

in

RFID

tags

without

wired

and

computationally

heavy

reasoners.

A

mobile

registry

based

on

an

m-DBMS

as

Oracle

Lite

is

Figure

Time

consumption

general

comparison

adopted

to

surrogate

the

presence

of

a

centralized

engine.

The

registry

adopts

an

OWL-S

Profile

instance

annotation

of

mobile

services

and

resources.

RFID

readers

are

considered

as

field

data

collectors.

They

are

able

to

retrieve

semantic

annotations

coming

from

tags

in

their

radio

range

and

automatically

address

a

discovery

request

without

wired

intermediaries.

The

feasibility

of

the

proposed

framework

has

been

tested

by

means

of

a

prototype

for

a

logistics

case

study

where

functionality

tests

have

been

carried

out.

Future

work

is

aimed

at

extending

the

approach

with

composition

and

substitutability

features

as

well

as

to

a

thorough

comparison

of

performances

w.r.t.

the

ones

obtainable

by

means

of

traditional

approaches,

and

to

adoption

of

other

recent

service/resource

description

frameworks.

Several

application

areas

of

RFID

technology

can

be

enhanced

by

introducing

a

semantically

rich

object

description

as

well

as

a

discovery

layer,

able

to

provide

advanced

services

to

a

user

in

a

wireless

context.

In

particular,

asset

management

can

be

greatly

improved

in

those

scenarios

where

retrieval

should

be

based

on

relevant

object

properties

and

purposes,

rather

than

on

mere

identification

codes.

Let

us

consider

the

lifecycle

of

industrial

products:

manufacturing

and

quality

control

can

exploit

accurate

descriptions

of

raw

materials,

components

and

processes;

supply

chain

management

benefits

from

improved

item

tracking

and

the

verification

of

multi-factor

service

level

agreements

between

commercial

partners

can

be

automated;

sale

depots

benefit

from

easier

inventory

management

and

can

introduce

u-commerce

(ubiquitous

commerce)

capabilities

without

expensive

investments

in

infrastructure;

finally,

smart

postsale

services

can

be

provided

to

purchasers,

by

integrating

knowledge

discovery

and

reasoning

capabilities

in

various

Apache

Software

Foundation,

jUDDI,

OWL-S:

Semantic

Markup

for

Web

Services,

appliances

Motivation

of

this

paper

comes

from

an

effort

to

provide

really

ubiquitous

environments

(as

the

one

proposed

in

where

semantics

is

exploited

to

annotate

objects

directly

affixing

to

them

a

tag

hosting

metadata

along

with

subsidiary

product

information..

In

a

traditional

Knowledge

Representation

System

(KRS)

automated

inference

procedures

are

basically

executed

on

a

fixed

server

in

order

to

extract

implicit

knowledge

from

the

one

stated

in

a

centralized

KB.

Hence,

in

traditional

KRSs,

a

reasoner

is

seen

as

a

software

entity

which

is

immediately

available,

either

locally

or

via

a

high-throughput

network

link.

This

approach

is

effective

only

as

long

as

large

computing

resources

and

a

stable

network

infrastructure

are

granted.

A

different

approach

is

needed

to

adapt

KR

tools

and

technologies

to

requirements

of

mobile

computing

applications.

They

are

characterized

by

user

(and

device)

mobility,

dependency

on

context,

severe

resource

limitations.

Hence,

knowledge-based

systems

designed

for

wired

networks

are

hardly

adaptable,

due

to

architectural

differences

and

performance

issues.

Our

goal

is

therefore

to

build

a

mobile

registry

providing

suitable

services

to

perform

a

discovery

directly

considering

objects

disseminated

within

the

environment,

so

making

unnecessary

the

presence

of

a

stable,

high

level

coordination.

In

this

manner

reasoning

tasks

are

fully

decentralized

and

can

be

distributed

between

wireless

nodes

providing

minimal

computational

capabilities.

In

this

subsection,

we

introduce

some

preliminary

notions

related

to

the

language

we

adopted

and

to

reasoning

tasks..

The

Language.

In

order

to

reduce

computational

costs

due

to

the

full

expressiveness

of

OWL

DL

we

selected

a

subset

of

it

where

class

descriptions

(also

used

to

represent

mobile

service

descriptions

and

queries)

consist

of:.

class

identifier

(a

URI

reference);.

owl:complementOf

class

identifier;.

datatype

property

restriction;.

the

intersection

of

two

or

more

class

descriptions..

Furthermore,

we

use

ontologies

where

all

the

axioms

contain

a

class

identifier

only

in

their

left

hand

side

and

for

rdfs:subClassOf

and

owl:equivalentClass

axioms,

only

one

axiom

is

allowed

for

each

class

identifier.

Notice

that

a

reader

also

can

itself

play

the

role

of

registry

w.r.t.

resources/services

simply

running

an

instance

of

the

application.

class

identifier

rdfs:subClassOf

class

description.

class

identifier

owl:equivalentClass

class

description.

class

identifier

owl:disjointWith

class

identifier

Due

to

the

structure

of

such

ontologies

and

class

descriptions,

classical

ontology

reasoning

tasks

such

as

subsumption

and

consistency

check

can

be

easily

reduced

to

set

comparison,

drastically

reducing

the

computational

needs.

Given

two

class

descriptions

-e.g.,

a

mobile

service

description

M

SD

and

a

query

Q-and

an

ontology

T

(for

Terminology)

proceed

as

follows:.

For

each

class

identifier

C

in

M

SD

and

Q:.

if

the

axiom

C

rdfs:subClassOf

D

is

in

T

recursively

rewrite

C

as

owl:intersectionOf

{C,

D};.

if

the

axiom

C

owl:equivalentClass

D

is

in

T

recursively

replace

C

with

D;.

if

the

axiom

C

owl:disjointWith

D

is

in

T

recursively

rewrite

C

as

owl:intersectionOf

{C,

owl:complementOf

D};.

After

this

preprocessing

step,

known

as

unfolding

both

M

SD

and

Q

are

rewritten

as

a

conjunction

of

class

identifiers,

negated

class

identifiers,

datatype

property

restrictions..

Subsumption.

In

order

to

verify

if

M

SD

is

subsumed

by

(is

more

specific

than)

Q,

just

check

if

for

each

conjunct

Ci

in

Q,

Ci

is

also

a

conjunct

of

M

SD..

Disjointness.

If

one

wants

to

check

if

Q

and

M

SD

are

disjoint

with

each

other

it

suffices

to

check

if

there

exists

a

class

identifier

Ci

in

Q

such

that

owl:complementOf

Ci

is

a

conjunct

of

M

SD

(the

same

is

if

we

flip

over

Q

and

M

SD)..

Concept

Abduction.

Based

on

this

set-based

formalization,

also

solutions

to

a

Concept

Abduction

Problem

(CAP)

can

be

easily

computed.

Roughly,

a

CAP

can

be

described

as:

given

two

class

descriptions

M

SD

and

Q,

such

that

M

SD

is

not

subsumed

by

Q

-i.e.,

the

mobile

service

description

does

not

completely

satisfy

the

query-hypothesize

a

class

expression

H

representing

what

is

underspecified

in

M

SD

in

order

to

be

more

specific

than

(subsumed

by)

Q.

From

an

operational

point

of

view,

for

each

conjunct

Ci

in

Q,

check

if

Ci

is

also

a

conjunct

of

M

SD.

If

not,

hypothesize

Ci

and

add

it

to

H.

We

write

H

solveCAP

(M

SD,

Q)

to

indicate

that

H

is

what

has

to

be

hypothesized

and

added

to

M

SD

in

order

to

completely

satisfy

the

request

Q..

Actually,

minimality

criteria

on

the

size

of

H

have

to

be

defined

and

adopted

in

order

to

avoid

trivial

and

redundant

solutions.

In

particular,

for

class

expression

represented

as

a

conjunction

of

elements,

in

irreducible

solutions

are

defined

as

solutions

that

are

minimal

w.r.t.

the

number

of

conjuncts

(taking

into

account

also

the

axioms

in

the

ontology

T

Here

we

can

define

Rank

potential

as

a

measure

for

abductionbased

ranking

of

several

services

w.r.t.

a

given

Q.

In

the

subset

of

OWL

DL

adopted

here,

it

is

easily

computed

as

the

number

of

hypotheses

that

have

to

be

made

in

order

to

fully

satisfy

Q,

i.e.,

Rpot(M

SD,

Q)

|H|

being

H

solveCAP

(M

SD,

Q)

O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Extended privilege inheritance in RBAC In existing RBAC literature, administrative privileges are inherited just like ordinary user privileges. We argue that from a security viewpoint this is too restrictive, and we believe that a more flexible approach can be very useful in practice. We define an ordering on the set of administrative privileges, enabling us to extend the standard privilege inheritance relation in a natural way. This means that if a user has a particular administrative privilege, then she is also implicitly authorized for weaker administrative privileges. We prove the non-trivial result that it is possible to decide whether one administrative privilege is weaker than another and show how this result can be used to decide administrative requests in an RBAC security monitor. Role-based access control (RBAC) [6] is a non-discretionary access control mechanism that simplifies the assignment of access rights to users. The basic idea is that while there are many access rights and users, rights and users can be grouped using a relatively small number of roles, ordered in a role hierarchy. In practice however, an RBAC system in a large enterprise may involve thousands of roles [4] . Keeping the access rights and roles up to date with changes in the enterprise may be a too big task for a single administrator. The usual approach to this problem is to divide the work and to allow delegation of part of the administrator's authority to other users. It is convenient to make this delegation mechanism flexible, in order to reduce the likelihood of bottlenecks and (administrative) users sharing keys or passwords that should remain secret. On the other hand, the delegation mechanism should be safe: users should not obtain rights other than those explicitly delegated by the administrator.. Several lines of research address the problem of delegation of administrative privileges in RBAC systems; Ferraiolo et al. [4] compare some of the different approaches. The main issue in these lines of research is how to model administrative privileges, as opposed to the ordinary user privileges, and to decide who should have them. In ARBAC [5] administrative privileges are assigned to a separate hierarchy of administrative roles and defined by specifying a range of roles that can be changed. Crampton and Loizou [3] take a more general approach, by using the same hierarchy for both the administrative privileges and the ordinary user privileges. Using the concept of administrative scope, they define which roles should have administrative privileges over other roles. In the Role-Control Center [4] , administrative privileges over roles are defined in terms of views, which are subsets of the rolehierarchy, and they can only be assigned to users assigned to these roles.. In existing RBAC literature [2, 3, 4, 5, 7] , administrative privileges are inherited just like ordinary user privileges. We argue that this approach is more restrictive than necessary for safety: consider a simple setting where an administrator has delegated the authority to some user u to assign a user u to a high role in the role-hierarchy. When user u uses this authority, user u becomes assigned to the high role, and consequently u can also play lower roles. There is no security motivation for not letting user u assign user u directly to (one of) the lower roles. User u could play the lower roles anyway. However, in standard RBAC, administrative privileges are not interpreted in this way.. In this paper, we define an ordering on the administrative privileges, enabling us to extend the standard privilege inheritance relation in a natural way. This means that if a user has a particular administrative privilege, then she is also implicitly authorized for weaker administrative privileges. Basically, this allows for a more flexible use of administrative privileges. We argue that decentralized management of RBAC becomes more flexible with this extension.. Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. With this work we make a contribution to the design of flexible administration models for RBAC. Flexible administration is important to cut the cost of maintenance and to enable the RBAC system to adapt to changing circumstances. Concretely, our contribution is an extension of the standard RBAC privilege inheritance relation. We defined an ordering on administrative privileges, that enabled us to extend the standard privilege inheritance relation in the natural way. This means that if a user has a particular administrative privilege, then she is also implicitly authorized for weaker administrative privileges. We showed that this relation is tractable. Our extension can be seen as an application of the principle of least privilege at the level of administration.. A number of improvements and additions can be made. We do not express privileges such as ∀r.addEdge(r , r)), which may be useful in practice, but we believe that special care is needed to deal with quantifiers. Finally, as we do not make a particular choice regarding constraints on the administrative privileges, it would be interesting to investigate how our results can be combined with, for example, the work by Crampton and Loizou [3] or that of Bandmann et al. [1] .

O O O O B O O B O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O B I B O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O B O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O B I O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B B I O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O B I O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O B O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O