Towards an integrated system model for testing and verification of automation machines Models and documents created during the development of automation machines typically can be categorized into mechanics, electronics, and software. The functionality of an automation machine is, however, realized by the interaction of all three of these domains. So no single model covering only one development category will be able to describe the behavior of the machine thoroughly. For early planning of machine design, virtual prototypes, and especially for the formal verification of requirements an integrated functional model of the machine is required. This paper introduces a technique which can be used to model automation machines on an abstract level, including coarse-grained descriptions of mechanics, electronics and software aspects with special focus on modeling domain-specific issues such as material flow and collision response. The resulting models are detailed enough to be simulated or verified but still suitably abstract to allow fast creation and efficient simulation. An important step during the development of any system is to check whether the system built actually adheres to its requirements. This check can either be performed by verification techniques, which are basically (machine supported) proofs of certain properties of an abstract model of a system, or by testing, which checks the properties only for a finite set of inputs, and consequently can only show errors of a system but never its correctness.. When looking at automation machines, e. g., for brick production, a system consists not only of software, but also of mechanical parts, sensors, and actors (to which we refer as hardware here). Thus it is usually not sufficient to test the software and hardware in isolation, but especially their interaction has to be taken into consideration. For example an object passing a sensor might trigger some software routine, whose decisions cause some actor to influence the mentioned object in some way.. Traditionally such machines could only be tested after assembly when both the hardware and software have been completed. This causes several problems, as any defects found after assembly usually require more effort to be fixed, potentially dangerous or destructive tests even might not be performed at all due to the high cost of the machine, and the testing process is hard to automate or parallelize. During the last decade several approaches have been proposed, which include running real software (i. e., final code on the actual controller) using a simulated machine (also known as virtual commissioning), or simulating both software and hardware 1 [1, 14] . However all of those approaches usually treat the software and hardware separately, which is to some part imposed by the development processes and tools in the area of automation engineering which still separate mechanical, electrical, and software design very strictly. In this paper we argued in favor of an integrated system model for describing automation machines in a manner suitable for simulation and reasoning about the machine (testing and verification). We presented requirements for such a modeling language and proposed a possible technique for describing such machine models. Of course the model presented in this paper is only the first step towards a methodology for testing and verifying automation machines, and as such still leaves many open questions.. A first set of questions deals with extending or refining our system model, e. g., by including continuous channels between components (i. e., instead of single values, functions over time are transmitted). Before taking further steps in this direction however, we first have to gain more experience in modeling different kinds of real machines to better understand the limitations of our approach. This is also a precondition for extending the language from production machines to other sectors of automation machines, such as machine tools or process technology, for which we especially expect to extend the material type system, e. g., supporting non-integral material quantities.. The other set of questions covers actual usage of the model, for which we might need the definition of formal semantics. These include test-case generation and verification of properties, which were the driving applications for creating our model. However, there are other possible applications of such a model, starting from discussing requirements with a customer or acting as the main point of communication during the development process, to using the model for the analysis of possible failures or planning of maintenance tasks. Some of these applications might require extensions to the model, such as annotations of fault behavior and error probability for components. Our work was heavily influenced by the Focus modeling theory [4] whose primary purpose is the description of reactive systems. There also is a modeling language and a tool based on Focus, called AutoFocus [3] . Our entire highlevel meta-model is similar to the one of AutoFocus and if we eliminate physical components and material ports from our model the remainder is nearly the same.. For describing the software part of the machines we also could have used any of the well-known approaches for modeling systems, such as state charts [7] , I/O automata [11] , Petri nets [13] , process algebras (e. g., CSP [9] ), or any of the many variants of them including hybrid extensions.. However none of the techniques listed so far has a notion of material, geometry, or collision detection and response. Thus they can in principle be used to describe these machines, but place a high burden on the modeler who has to close the gap between these domain concepts and the provided (rather low level) modeling concepts.. SysML (Systems Modeling Language) [12] is a language for modeling systems by the Object Management Group. It is based on UML and as such shares some of its drawbacks, such as (partially) unclear semantics and an overwhelming multitude of modeling constructs. Additionally the objections given for all other techniques before also apply here, as support for material flow and collisions is missing.. Simulation models used for virtual commissioning (softwarein-the-loop test with controller hardware and simulated machine) are another source for modeling techniques. Existing industrial solutions however do not couple the geometry tightly to the machine's components, but only describe reactions of a visualization model to state changes of the machine. For example the SEMI project (Simultaneous Engineering for Development of Machines with Micro-systems) [1] used ROOM and C++ for modeling the simulated machine. Consequently support for continuous changes within the machine, material flow, or collision detection and response had to be simulated somehow by the modeler.. Collision detection and response are one of the main areas treated by physical simulations. A common drawback is their missing support for discrete changes, which may be caused by collisions or logical signals. The modeling language Modelica [15] supports both continuous flows and discrete changes (hybrid modeling). For collision detection and response an extension is proposed in [6] . What makes these models inappropriate for our purposes is the high level of detail required for physically exact simulation (e. g., mass, moment of inertia, friction coefficients) which is often not available during early planning stages. Furthermore this makes it hard to model parts of the machine at different levels of abstraction, as we always have to respect physics (which we may violate in our models).

O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O B O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Trust and Security in RFID-Based Product Authentication Systems Abstract-Product authentication is needed to detect counterfeit products and to prevent them from entering the distribution channels of genuine products. Security is a critical property of product authentication systems. In this paper, we study trust and security in RFID-based product authentication systems. We first present a formal definition for product authentication process and then derive the general chain of trust as well as functional and nonfunctional security requirements for product authentication. Most of the scientific literature that covers the topic focuses on cryptographic tag authentication only. This paper, however, provides a broader view including also other known approaches, most notably location-based authentication. To derive the functional security requirements, we employ the concept of misuse cases that extends the use case paradigm well known in the field of requirements engineering. We argue that the level of security of any RFIDbased product authentication application is determined by how it fulfills the derived set of functional and nonfunctional requirements. The security of different RFID-based product authentication approaches is analyzed. To study how RFID supports secure product authentication in practice, we investigate how the current EPC standards conform to the functional security requirements of product authentication and show how the unaddressed requirements could be fulfilled. The benefits of implementing a service that detects the cloned tags in the level of the network's core services are identified.Index Terms-Product authentication, product codes, radio frequency identification (RFID), security, system analysis and design. T HERE is an ever growing risk that physical products are not what they claim they are. Along with legally run businesses, there is a full-size underground industry that produces and distributes illegal copies of virtually all kinds of products [17] . As an illustration of the extent of the problem, the German customs secured 117 containers of counterfeit and pirate products in the Hamburg port between August and November 2006, constituting probably the world's largest counterfeit seizure. The infringing goods included, for example, more than one million pairs of counterfeit Nike, Adidas, and Puma sports shoes, counterfeit toys, and over 100 000 counterfeit textiles, with a corresponding overall original retail value of over 383 million euros [24] . In total, the European customs seize up to a hundred million counterfeit and pirated goods every year [49] .. Companies can launch countermeasures against counterfeiting at different fronts. These comprise legal actions, consumer education, private investigations, and technological countermeasures. The first three of these are rather inefficient. They are expensive and slow and can only address a part of the problem. In addition, counterfeiters are adaptive and can continue or restart their businesses after these measures. The technological countermeasures, however, have the potential to destroy the counterfeiters' business model: Today mass products flow anonymously and counterfeiters can "free-ride" the supply chain of genuine products. If this licit supply chain would be secured by giving each item an identity and by implementing reliable ways to prove these identities, distributing counterfeit products through this channel would become substantially harder-and economically unattractive.. With the development of mass serialization and Automatic Identification (Auto-ID) technologies, in particular radio-frequency identification (RFID), the technical countermeasures have enjoyed an increasing importance. There are three major motivations for using RFID in product authentication. First, RFID has recognized potential in anti-counterfeiting [18] because it allows for many ways to securely authenticate products [10] . Different RFID-based product authentication approaches are presented in detail in Section II. Second, RFID will be adopted anyway in many applications due to its benefits in retail industry and logistics, so also the potential for secure product authentication will be given. A market study of GS1 and LogicaCMG [19] illustrates the expected adoption rate of RFID in Europe. The study estimates that the number of RFID tags purchased annually in 5, 10, and 15 years in Europe alone is 3 billion, 22 billion, and 86 billion tags, respectively. The same study concludes that the most growth is coming from tagging of (high-value) items, instead of pallets or cases, and the adoption is driven by retail and consumer goods industry. One of the objectives of our study is to identify how the technology should be implemented so that all these tagged products could be securely authenticated with relatively small additional investments. The third motivation to use RFID in product authentication is the emergence of near field communication (NFC) technology. NFC denotes a technology that allows for integrating RFID functionality in a mobile phone, making it both a RFID transponder and a reader device [21] . According to predictions of ABI research, in the year 2011 a total of 450 million handsets (30% of all handsets) will be NFC-enabled [20] . Because the NFC handsets might become the world's largest RFID reader infrastructure in the future, solving the interoperability problems between NFC and other RFID standards, EPC in particular, 1 is of great interest for the industry and actively addressed by both practitioners [22] and the scientific community [23] . If these two technologies will converge, also the end-users and consumers could take part in verifying the authenticity of tagged products. In addition, this could help changing the consumers' risk perception towards RFID [42] by showing them what concrete benefits the technology can give them.. In this paper, we study trust and security in authentication of RFID tagged products. Overall, the existing theoretical knowledge of level of security different product authentication approaches provide or different products require within the context of product counterfeiting is sparse. In particular, formal definitions for level of confidence in product authentication or location-based authentication do not exist, though these concepts have high practical importance. Our goal is not to contribute towards improved RFID tag security, but towards secure overall systems to authenticate tagged products. Therefore, an important contribution is to derive the general chain of trust as well as security requirements of RFID-based product authentication. The set of functional and nonfunctional requirements is meant for designers of product authentication systems and it also can be used to benchmark the level of security of existing systems. Most related scientific literature covers cryptographic tag authentication only, but companies who want to authenticate their tagged products have no such bias. Therefore, we present a broader view of how RFID can be used to implement secure product authentication. Understanding the security requirements of different approaches is important because there are many different proposed RFID-based product authentication approaches (e.g., [10] ) but so far no methodology to validate and compare the level of security different approaches provide. This paper is organized as follows. In Section II, we review related scholarly contributions and distinguish three distinct approaches how products can be securely authenticated plus a fourth category of techniques that cannot provide a comparable level of security. In Section III, we present, first, formal definitions for product authentication process and location-based authentication. Section IV presents the nonfunctional security requirements for product authentication. To derive the functional security requirements in Section V, we apply the misuse case methodology proposed by Sindre and Opdahl [2] . In Section VII, we analyze the security of different RFID-based product authentication approaches from the point of view of the counterfeiter by arguing that the level of security depends on how well the derived requirements are met. In Section VIII, we analyze RFID-based product authentication in practice by presenting how the current EPC network [30] , which is the most important standard for networked RFID, conforms to the derived set of requirements. We finish with discussion and conclusions. 1 [Online]. Available: http://www.epcglobalinc.org Even though the vast majority of related literature only focuses on cryptographic RFID tag authentication, the ultimate goal behind these scholarly contributions is secure authentication of RFID-tagged products. Therefore, we have approached the problem from a broader perspective that is more similar to that of the affected companies who in the end will be the actual users of RFID technology. We have presented tag authentication, verification of object specific features, and location-based authentication as comparable options for authentication of tagged products. We have formulated a formal definition for product authentication process and derived the functional and nonfunctional security requirements for product authentication based on the underlying chain of trust. We have taken steps towards quantifying the different threats against the authentication process by assessing the involved risks in terms of consequences and likelihood. This risk assessment can be further revised by affected companies with product specific data when it will be available. We have estimated the level of security of different approaches in terms of cost to copy multiple products and probability of detecting copied products, which we argue are the elements that define the level of protection against adversaries seeking for financial gain. In particular, we argue that even modest tag cloning resistance can have a major impact on a counterfeiter's business case if clones can be detected with some probability, since then the counterfeiter needs to crack not one, but multiple tags. Our analysis of the EPC network shows that tag authentication is supported conceptually but not yet in practice, and that the forthcoming EPC discovery services will play an important role in guaranteeing the completeness of the history for location-based product authentication. Last, we uncovered structural shortcomings in the EPC network's support for location-based product authentication and presented how the shortcomings could be overcome by an EPC trace analysis service residing in the network's core service level. For a company affected by product counterfeiting, RFID tag authentication represents only one possible technique to authenticate products, and RFID only one candidate technology for the solution. Therefore, we believe that the broader view to authentication of RFID-tagged products that this paper promotes is relevant to the practitioners. In addition, since the existing theoretical knowledge of level of security different product authentication approaches provide or different products require is sparse, our formal investigation also provides a theoretical contribution.. This paper addresses security in terms of how well the functional and nonfunctional security requirements are satisfied, but it is important to note that the level of security of a running product authentication system is, ultimately, defined by its security policy and security mechanisms. Security policy is a specific statement of what is and is not allowed and security mechanisms enforce the policies [25] . In practice this means, for example, that it is not enough to have a secure tag authentication protocol if the people using the system do not verify the tag-product integrity. Moreover, technology alone is not enough to secure a product authentication system; for example, injection of false information remains an unaddressed threat in the EPC network because there is no undisputable proof that a custodian really has the product. In addition, the brand owners need to trust that entities who use the product authentication system want to use it to detect fake products and know how to do it. Also, secure and scalable key distribution is not yet solved for RFID. Solving these problems represents major organizational challenges for affected companies.. Our results can also be generalized beyond RFID. Although we derived the security requirements for RFID-tagged products, they can be extended to product authentication in general by considering tags as any kind of identifier or security feature that is used to identify and authenticate a product, such as barcode label or invisible ink. For example, the RFID tags could be replaced by 2-D barcodes without any implications to the level of security of location-based authentication, given that the back-end infrastructure remains unchanged.. Alexander [1] states that neutralizing all possible threats by misuse case analysis would be wishful thinking and cannot be stated as a requirement, but recognizes that also partial mitigations are useful as long as they afford a realistic increase in protection at a reasonable cost. This supports our claim that the derived set of functional security requirements can be used to benchmark the level of security of any RFID-based product authentication system. Understanding the level of protection different product authentication approaches provide is very important in order to provide the amount of protection a product needs depending on its sales price, distribution channel, life-cycle, and liability. Sandhu [48] argues that the level of security of a system should always be good enough but not more because too high levels of security lead to unnecessary costs, decreased flexibility, and reduced usability. The remaining research challenge is to find out, which approaches presented in this article provide this good enough security for which products. In particular, it is not yet known what the minimum level of visibility is that is needed to secure a distribution channel with the location-based authentication approach.

O O B O O B I O O O O O O O O O O O O O O O O O O O O O B O O O O O B I O O O O O O O O B O O B I O O O O O O O O B I O O O O O O O O O O O O O O O B O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O B I O O O O O O O O O O O O O O O O B O O O B I O O O O O O O O O B I O O O O O O O O O O O O O B O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I B I I I B B I I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O B O B I O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O B O O O B I O O O O O O O O O O O O B I O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O B O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O B I O O O O O O O O O B O O B I O O O O B O O O O O O O O O O O O O O O O O O O O O O O B O O O B I O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O B O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O B I O O O O O O O O O O O O O O O O O O O B O O O O O O O O O B O O O O O O O O O O O O O B O O O B I O O O O O O B O O B O B O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O B I O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O B O O O B I O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


FESCIM: Fair, Efficient, and Secure Cooperation Incentive Mechanism for Multihop Cellular Networks Abstract-In multihop cellular networks, the mobile nodes usually relay others' packets for enhancing the network performance and deployment. However, selfish nodes usually do not cooperate but make use of the cooperative nodes to relay their packets, which has a negative effect on the network fairness and performance. In this paper, we propose a fair and efficient incentive mechanism to stimulate the node cooperation. Our mechanism applies a fair charging policy by charging the source and destination nodes when both of them benefit from the communication. To implement this charging policy efficiently, hashing operations are used in the ACK packets to reduce the number of public-key-cryptography operations. Moreover, reducing the overhead of the payment checks is essential for the efficient implementation of the incentive mechanism due to the large number of payment transactions. Instead of generating a check per message, a small-size check can be generated per route, and a check submission scheme is proposed to reduce the number of submitted checks and protect against collusion attacks. Extensive analysis and simulations demonstrate that our mechanism can secure the payment and significantly reduce the checks' overhead, and the fair charging policy can be implemented almost computationally free by using hashing operations. In this paper, we have proposed a fair, efficient, and secure cooperation incentive mechanism for MCN. In order to fairly and efficiently charge the source and destination nodes, the lightweight hashing operations are used to reduce the number of public-key-cryptography operations. Moreover, to reduce the overhead of the payment checks, one small-size check is generated per session instead of generating a check per message, and the Probabilistic-Check-Submission scheme has been proposed to reduce the number of submitted checks and protect against the collusion attack. Extensive analysis and simulations have demonstrated that our incentive mechanism can secure the payment and significantly reduce the overhead of storing, submitting, and processing the checks. In addition, replacing the destination node's signatures with the hashing operations can charge the source and destination nodes almost computationally free.. In this paper, instead of generating two signatures per packet (one from the source and the other from the destination), we have replaced the destination node's signature with hashing operations to reduce the number of public-key-cryptography operations nearly by half. The source node attaches a signature in each data packet to ensure the payment nonrepudiation and to verify the message integrity at each intermediate node to thwart FreeRiding attacks. In our future work, we will focus on reducing the number of public-key-cryptography operations due to the source node's signatures. Although the payment nonrepudiation can be achieved using a hash chain at the source node side, we will study how to efficiently verify the message integrity at each intermediate node. In addition, similar to the existing incentive mechanisms, FESCIM can thwart selfishness attacks, but it cannot identify the irrational nodes that involve themselves in sessions with the intention of dropping the data packets to launch Denialof-Service attacks. In our future work, we will study how the AC can process the checks to identify the irrational nodes. In FESCIM, if two nodes ID A and ID B submit checks with Sig S ðS i ; X; HðM X ÞÞ and Sig S ðS i ; X À 1; HðM XÀ1 ÞÞ, the AC can learn that the data packet number X is dropped by an intermediate node A, B, or in-between node. However, packets may be dropped sometime, e.g., due to mobility or bad channel, or maliciously, but frequently dropping packets is an obvious malicious behavior. In our future work, we will study how the AC can precisely differentiate between the honest nodes and the irrational packet droppers in order to reduce the number of honest nodes that are falsely identified as irrational packet droppers. . For more information on this or any other computing topic, please visit our Digital Library at www.computer.org/publications/dlib. Although our focus was on the unidirectional data transmission in the previous sections, FESCIM can also be applied for bidirectional data transmission. In this case, FESCIM can bypass sending some ACK packets by using the data packets to serve as ACKs. Fig. 9 shows the exchanged security tags in FESCIM for bidirectional data transmission assuming that the nodes ID A and ID B send X2 and X1 messages, respectively, and X2 > X1. The Xth data packet sent from ID A to ID B contains S i , X, the message M A;X and its hash value, and the signature Sig A ðS i ; X; HðM A;X ÞÞ. The Xth data packet sent from ID B to ID A contains S i , X, the message M B;X and its hash value, and the signature Sig B ðS i ; X; HðM B;X ÞÞ. The security tag Sig B ðS i ; X; HðM B;X ÞÞ means that node ID B has sent X messages to ID A and has also received X messages from ID A . After ID B sends all its messages, it switches to the hash-chain-based ACKs to enable ID A to complete sending its messages. The first ACK packet contains ID B 's signature for a hash chain root ðH Z B ð1ÞÞ and X1. Fig. 10a shows the check format of the bidirectional data transmission.. FESCIM can also be used for asymmetric paths. As shown in Fig. 11 , the path P1 with the intermediate nodes ID 1 and ID 2 can only transport packets from ID S to ID D , and the path P2 with the intermediate nodes ID 3 and ID 4 can only transport packets from ID D to ID S . The Xth data packet in P1 contains Data P1 ðXÞ that is similar to the data packet in Fig. 3 , and ACK P1 ðX À 1Þ that contains the destination node's ACK for the message M XÀ1 , where ACK P1 ðX À 1Þ is sent from ID D to ID S through P2. The Xth data packet in P1 also contains the source node's ACK for the X À 1th data packet sent through P2 ðACK p2 ðX À 1ÞÞ to enable ID 3 and ID 4 to compose checks. In other words, P1 transports the source node's messages and P2 transports the ACKs of the messages. The source and destination nodes compose two hash chains by iteratively hashing random values to obtain the hash chains' roots ðH ; ID D ; T S ; P r . The source and destination nodes release one element from their hash chains, i.e., Data P2 ðXÞ contains a hash value from the destination node's hash chain to acknowledge the data received from ID S through P1, and ACK P2 ðX À 1Þ contains a hash value from the source node's hash chain to acknowledge receiving Data P2 ðX À 1Þ. ID 1 and ID 2 can compose checks using the mechanism discussed in Section 4.1, and Fig. 10b shows the composed checks by ID 3 and ID 4 . In tamper-proof device (TPD)-based incentive mechanisms [17] , [18] , [19] , [20] , [21] , a TPD is installed in each node to manage its credit account and secure its operation. In Nuglets [17] , [18] , the self-generated and forwarding packets are passed to the TPD to decrease and increase the node's credit account, respectively. The packet purse and the packet trade models have been proposed. In the packet purse model, only the source node pays by loading some credits in each packet before sending it. Each intermediate node acquires the amount of credits that cover the packet's relaying cost. In the packet trade model, each intermediate node runs an auction to sell the packets to the following node in the route. In this way, each intermediate node earns some credits and the destination node pays the total packet relaying cost. In SIP [19] , after receiving a data packet, the destination node sends a payment RECEIPT packet to the source node to issue a REWARD packet to increment the credit accounts of the intermediate nodes. In CASHnet [20] , [21] , the source node's traffic credit account is charged and a signature is attached for each data packet. Upon receiving the packet, the destination node's traffic credit account is also charged and a digitally signed ACK packet is sent back to increase the helper credit accounts of the intermediate nodes. Users regularly visit service points to buy traffic credits with real money and/or transfer helper credits to traffic credits.. The TPD-based incentive mechanisms suffer from the following problems. First, the assumption that the TPD cannot be tampered is neither secure nor practical for MCNs. That is because the nodes are autonomous and selfinterested and the attackers can communicate freely in an undetectable way if they could compromise the TPDs [22] . Moreover, since the security protection of these mechanisms completely fails if the TPDs are tampered, only a small number of manufacturers can be trusted to make the network nodes, which is too restrictive for civilian networks. Second, a node cannot communicate if it does not have sufficient credits at the communication time. The nodes at the network edge cannot earn as many credits as the nodes at other locations because they are less frequently selected by the routing protocol. Furthermore, the credit distribution has direct impact on the network performance, e.g., if a small number of nodes have a large ratio of the network credits, the network performance significantly degrades because the rich nodes are not motivated to cooperate and the poor nodes cannot initiate communications. Finally, since credits are cleared in real time, the network performance degrades if the network does not have enough credits circulating around. In [23] , it is shown that the overall credits in the network decline gradually because the total charges are not necessarily equal to the total rewards. That is because the source node is fully charged after sending a packet but some intermediate nodes may not be rewarded when the route is broken. Although CASHnet can alleviate this problem by buying credits with real money, it is shown in [23] that in spite of having helper credits, some nodes starve because they cannot find a service point to convert them to traffic credits.. In order to eliminate the need for TPDs, a central bank called the AC can be used to store and manage the nodes' accounts. In [24] , the source node appends a payment token to each transmitted packet, and each intermediate node uses its secret key to check whether the token corresponds to a winning ticket. Winning tickets are submitted to the AC to reward the winning nodes. The source and destination nodes are charged per packet but the intermediate nodes are rewarded per winning ticket. In a security flaw, the colluding nodes can exchange tokens to be checked in each node to steal credits. In our earlier work [25] , instead of submitting payment checks to the AC, each node submits an activity report containing its alleged charges and rewards of different sessions. The AC uses a reputation system to identify the cheating nodes that report false charges and/or rewards to steal credits. However, due to the nature of the reputation systems, some honest nodes may be falsely identified as cheaters and the colluding nodes may manage to steal credits.. In [26] , each node in a route buys packets from the previous node and sells them to the next node. The packets' buyers contact the AC to get deposited coins and the packets' sellers submit the coins to the AC to claim their payment. However, the interactive involvement of the AC in each communication session is not efficient and creates a bottleneck at the AC. In [27] , an incentive mechanism has been proposed for MCN. Unlike the original MCN architecture proposed in [1] , the base stations are involved in every communication session, which may lead to suboptimal routes when the source and destination nodes reside in the same cell. In addition, the corrupted messages are relayed to the base station before they are dropped because the intermediate nodes cannot verify the authenticity and the integrity of the messages.. In Sprite [28] , the source node signs the identities of the nodes in the route and appends its signature to each transmitted message. The intermediate and the destination nodes compose checks and submit them to the AC to claim the payment. In Express [29] , the source node generates a hash chain for each intermediate node ID K and commits to the hash chain by digitally signing the root of the hash chain and sending the signature to ID K . Each time the node ID K relays a message, the source node releases the preimage of the last sent hash value. The source, intermediate, and destination nodes compose checks and submit them to the AC. However, the nodes have to generate and store a large number of hash chains because any node in the network may act as an intermediate node due to the node mobility. The packet overhead is large especially if the number of intermediate nodes is large because the source node attaches one hash value for each intermediate node. In Sprite and Express, only the source node pays no matter how the destination node benefits from the communication. Moreover, since the intermediate nodes are rewarded for the relayed messages that do not reach the destination, all the nodes in a route submit the checks because packet relay is considered successful by a node if a next node in the route submits a valid check. We call this check submission scheme All-Submitters because all the intermediate nodes submit all the checks. In Sprite and Express, significant communication and computation overhead is implied due to generating and submitting a large number of checks because a check is generated per message and all the nodes in a route submit all the checks.. In [30] , an incentive mechanism has been proposed for ad hoc networks that are used to connect the nodes to the Internet. The source node signs the identities of the nodes in the route and appends this signature to the message, and the destination node signs a check and sends it to the last intermediate node to submit to the AC. Since only the last intermediate node submits the check, we call this check submission scheme Fixed-Submitter. However, the source and destination nodes can communicate freely and the intermediate nodes are not rewarded if the last intermediate node colludes with the source and destination nodes to not submit the checks. Moreover, generating two signatures per message is too costly for mobile nodes. In [31] , a hash chain is used to efficiently authenticate digital streams but FESCIM uses a hash chain to achieve payment nonrepudiation to secure the payment.

O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Schedule-aware performance estimation of communication architecture for efficient design space exploration In this paper, we are concerned about the performance estimation of bus-based architectures assuming that the task partitioning on the processing components is already determined. Since the communication behavior is usually unpredictable due to dynamic bus requests of processing components, bus contention, and so on, simulation based approach seems inevitable for accurate performance estimation. But it is too time consuming to explore the wide design space. To overcome this serious drawback, we propose a static performance estimation method that is based on the queuing model and makes use of memory traces and task execution schedule information. We propose to use this static estimation approach to prune the design space drastically before applying a simulation-based approach. Comparison with tracedriven simulation results proves the validity of our static estimation technique. In system level design, selection of appropriate communication architecture is a critical design step. In this paper we assume that the system behavior is modeled as a composition of function blocks. Differentiation between functions and communication allows the system designer to explore the communication architecture independently of component selection. Then, communication architecture selection is performed after a decision is made on which processing components are used and which function blocks are mapped on which processing components. And a task is defined as a group of function blocks sequentially scheduled on a processing component.. The key tool for exploring the design space of communication architecture is to estimate the performance of communication architectures, which is the main theme of this paper. In particular, we are concerned about the bus-based architectures since the busbased architecture is most widely adopted due to its simplicity and popularity. From the mapping result of function blocks to the processing elements, we obtain the bus requests from the processing elements and those bus requests are input data to the performance estimation tool. Unlike the previous work similar to ours [8] , we take into account the bus requests for the local memory accesses as well as for the shared memory access of intercomponent communication.. Since the communication behavior is usually unpredictable due to dynamic trace of memory accesses, bus contention, and so on, simulation based approach seems inevitable for accurate performance estimation. However, since the memory traces of processing elements are enormous, trace driven simulation needs a huge data storage for simulating only a few seconds of execution of application. Some commercial tools and research tools use execution-driven simulation where the simulator executes the tasks to produce the bus requests on-line which are passed to the module that accurately models the communication architecture. But the main drawback of a simulation-based approach is that it is too slow to be used for exploring the wide design space of architectures.. Even after a specific bus standard is chosen to be used, the design space can still be huge if a single bus segment cannot accommodate all memory requests within a given time budget. For example, we need to determine how many bus segments are used with what topology and which processing elements and memory banks are mapped to which bus segments. We also have to decide the memory types and memory system configurations. If we include the selection of bus operation frequency and arbitration policy, the design space explodes.. Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. To explore the wide design space, we need a fast and accurate performance estimation method while the simulation-based approach is too slow. To overcome this difficulty, we propose a two-step communication architecture exploration scheme. We propose a static performance estimation method that is based on the queuing model and makes use of memory traces and task execution schedule information. We use this static estimation approach to prune the design space before applying a simulationbased estimation. As the static estimation gets more accurate, the design space to be explored by simulation would be narrower. The key contribution of this paper is to propose an accurate static estimation method taking into account of all dynamic behaviors due to bus contention and dynamic memory traces. We show the effectiveness of our method in terms of estimated time accuracy of entire execution compared with the results of trace-driven simulation.. The remainder of this paper is organized as follows. In section 2 we state our proposed design space exploration framework and outline the performance estimation techniques. Section 3 reviews some related works. In section 4 the queuing model for a prioritybased single bus is explained. Section 5 contains the detailed discussion on the estimation method considering a task schedule and memory traces and on the extension to multiple bus systems. In section 6 we give some experimental results and draw conclusions in section 7. In this paper, we presented an efficient static estimation technique of fixed-priority based communication architecture. It is based on the queuing model and makes use of the schedule information and memory traces. Since the estimation time is polynomial to the number of processing components, the number of tasks, and the number of bus segments, the proposed technique can be used to prune the large design space before trace-driven simulation. Experimental results show our proposed technique performs well providing suitable estimation error, at most 10% to 15%, compared with trace driven simulation in various communication architecture configurations.. Future researches will be focused on the development of design space exploration algorithm and the modeling of other bus arbitration schemes such as round robin and TDMA.

O B I O B I O O B I I O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O B I O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O B I I O O O O O O O O O O O O O O O


A multi-level approach to reduce the impact of NBTI on processor functional units NBTI is one of the most important silicon reliability problems facing processor designers today. The impact of NBTI can be mitigated at both the circuit and microarchitecture levels. In this paper, we propose a multi-level optimization approach, combining techniques at the circuit and microarchitecture levels, for reducing the impact of NBTI on the functional units (FUs) of a highperformance processor core. We perform SPICE simulations to evaluate the impact of circuit-level design optimizations to reduce the NBTI guardband in terms of area, delay, and power. We then propose a set of NBTI-aware dynamic instruction scheduling policies at the microarchitecture level and quantify their impact on application performance and guardband reduction through executiondriven simulation. We show that carefully combining techniques at both these levels provides the most attractive solution to reducing the guardband while imposing the least overhead in terms of area, power, delay, and application performance. Silicon reliability is one of the key challenges facing the microprocessor industry today. There is a myriad of reliability issues that processor designers have to cope with, including soft errors, hard errors, and process variation. One of the key emerging hard error problems is Negative Bias Temperature Instability (NBTI). NBTI affects the lifetime of PMOS devices and occurs when a logic input of '0' (i.e., a negative bias) is applied at the gate of the transistor. This negative bias leads to the generation of interface traps at the Si/SiO2 interface. These interface traps cause the threshold voltage of the transistor to increase, thereby lowering the speed of the device and the noise margin of the circuit which finally lead to a circuit failure [12, 9] . However, some of the interface traps can be Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. To copy otherwise, to republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. eliminated by applying a logic input of '1' to the device, putting the device into a "recovery mode" [1] .. NBTI affects both the cycle time and the stability of storage structures within the processor. These problems are typically addressed via guardbanding. Guardbanding accounts for the degradation in cycle time and the stability of the storage structures over the lifetime by reducing the operating frequency and increasing the minimum voltage of the storage elements (Vmin). Typically, 20% of the cycle time is reserved as a guardband for NBTI and a 10% increase in threshold voltage (Vt) can be handled with a 10% increase in Vmin [1] . However, reducing the frequency and increasing Vmin have a detrimental impact on performance and power respectively and therefore it is desirable to reduce the guardband via the use of NBTI mitigation techniques. In this work, we look into guardband reduction techniques to address the degradation in cycle time.. Techniques for putting PMOS devices into the recovery mode can be implemented at both the circuit and microarchitecture levels in the processor. The goal of circuit-level techniques is to design the structures such that as many PMOS devices as possible in the structure can be put into the recovery mode whenever possible. Circuit-level techniques typically attempt to tackle NBTI at the granularity of a single structure. Microarchitecture level techniques, on the other hand, can manage NBTI for several structures within the processor core using techniques such as instruction fetch and scheduling policies. There are tradeoffs in implementing NBTI recovery at each of these levels in the system in terms of area, power, performance, complexity, and, their effectiveness in reducing the guardband.. In this paper, we present a quantitative analysis of NBTI recovery techniques at the circuit and microarchitecture levels for the functional units (FUs) in the cores of a high-performance multicore processor. We choose to study FUs because of the general trend in multicore processor design, where more cores are integrated onto the die each sucessive generation but the cores themselves tend to be relatively simple and have only a small number of FUs. In this scenario, the failure of even one FU could seriously jeopardize the ability of that core to provide high performance. We characterize the effectiveness of NBTI mitigation at both the circuit and microarchitecture levels and quantify their impact on other important figures of merit, such as, area, delay, and application performance. The objective of this chracterization study is to identify those techniques that can effectively reduce the guardband but have the least amount of performance impact on applications, as well as impose minimal overheads in terms of area, power, and delay. We then show that lightweight optimizations at each level is more effective in reducing the guardband without adversely affecting the other figures of merit than applying more extensive changes at any one level. To the best of our knowledge, this is the first paper to systematically analyze NBTI recovery techniques at each of these levels for FUs and develop multi-level optimization techniques to tackle this important reliability problem.. The specific contributions of this paper are:. • We propose and evaluate three different NBTI-aware FU designs in terms of guardband reduction, area and delay. We show that, on an average, the three different designs provide a guardband reduction of 42%, 46% and 47% over the baseline configuration.. • We then propose three different NBTI-aware scheduling policies and evaluate their impact on performance and guardband reduction. We show that, on average, the three policies provide a guardband reduction of 43%, 54% and 63% over the baseline FU configuration.. • Finally, we analyze the effectiveness of combining lightweight optimizations at each level and show that this approach provides a 56% guardband reduction with minimal impact on other figures of merit.. The outline of the rest of this paper is as follows. The next section discusses the related work and the NBTI mitigation techniques we consider are described in Section 3. The experimental methodology is described in Section 4. The results are presented in Section 5 and Section 6 concludes this paper. NBTI is one of the most important silicon reliability problems facing processor designers. In this paper, we evaluate both circuit and microarchitecture level approaches to reduce the NBTI guardband for the FUs of a high-performance processor core. At the circuit-level, we use an optimized version of a partitioned FU design and evaluate several design points in terms of their effectiveness in reducing the guardband and also their area, delay, and power. At the microarchitecture-level, we propose and evaluate a set of NBTI-aware dynamic instruction scheduling policies and evaluate their impact in terms of guardband reduction and performance. Finally, we show that a multi-level optimization approach, which combines the benefits of both circuit and microarchitecture level optimizations, is the most effective in reducing the guardband while imposing little overhead in terms of area, power, delay, and performance. NBTI mitigation techniques roughly fall into two categories: those that aim to reduce the stress on the PMOS devices by controlling V dd , Vt, and temperature, and those that try to increase the recovery time to facilitate detrapping.. There have been several studies into enhancing the reliability of FUs at both the circuit and microarchitecture levels. [1, 6] tackle NBTI-induced wearout problems by feeding specific inputs into the FUs during idle periods to increase the recovery time. [16] uses temperature-based job-scheduling to individual cores of a multicore processor in conjunction with V dd and Vt control to hide the effects of aging due to NBTI. There also has been prior work on fault tolerant designs and hard error detection schemes for FUs. [3] proposes a microprocessor design integrated with a dynamic verification based error detection mechanism to diagnose hard faults in FUs. [7] presents a fault-tolerant design of the Kogge-Stone Adder that leverages its inherent redundancy to continue reliable operation even in the presence of hard errors.. While all these prior works propose optimizations at the circuit or microarchitecture level, to our knowledge there is no systematic analysis of NBTI optimizations for the FU at each level and an exploration of multi-level optimization techniques to tackle this problem. Fu et al. [5] propose multi-level optimization for soft error mitigation for SRAM arrays in SMT processor cores and show that such combined approaches are attractive in terms of reliability, performance, and power. In this paper, we show that a multi-level approach is more attractive for NBTI mitigation in the FUs of a high-performance processor than a circuit-only or microarchitecture-only approach. Our circuit-level modeling is performed via SPICE-level simulation using the Cadence Virtuoso Spectre circuit simulator [4] for the 32nm process using the Predictive Technology Model [11] . Our architecture-level evaluations are carried out via execution-driven simulation using the M5 simulator [2] . We simulate a 4-wide issue core, which is representative of cores used in multicore processors today, that runs at a 3 GHz clock frequency and has a supply voltage of 0.9V. We use all 26 benchmarks from the SPEC CPU2000 benchmark suite in our evaluations [15] . The benchmarks are compiled for the Alpha ISA and use the reference input set. We perform detailed simulation of the first 100-million instruction SimPoint for each benchmark [13] .. In this paper, we focus on the impact of NBTI on the integer ALUs only. Although we consider both integer and floating-point benchmarks in our evaluations, several of the floating-point benchmarks have a considerable number of integer instructions in their instruction mix and therefore make heavy use of the the integer ALUs [14] . We present our results for only the integer ALU with the lowest sequence number since this ALU tends to be the most heavily utilized of all the ALUs with conventional instruction scheduling, as explained in Section 3.2. Since NBTI affects the threshold voltages of PMOS devices in the FUs, the delay of the FU hardware increases which causes a potential danger to meet the timing constraints. Guardbanding is used to protect a circuit from failure, which entails both performance and power penalties. In all our experiments, we assume that the baseline processor uses the unpartitioned FU design, the PS instruction scheduling policy, and a guardband of 20% [1] .. In our evaluations, we use the percentage reduction in the guardband with respect to the baseline as the figure of merit to quantify the extent to which a particular design mitigates the impact of NBTI. To compute guardband reduction, we track the stress and recovery cycles of the FUs in the architectural simulations. Using these statistics, we estimate the degradation in Vt after a 7-year service life [16] , using which we calculate the delay degradation in the structures and finally the guardband reduction. We also quantify the impact on other important figures of merit, such as, area, delay, and application performance (in terms of IPC), to study the effectiveness of NBTI mitigation at both the circuit and microarchitecture levels.. Our goal is to evaluate the extent to which optimizations at only the circuit or microarchitecture level can reduce the guardband and ascertain the costs incurred in applying these optimizations on the other figures of merit. These results are presented in Sections 5.1 and 5.2. Based on this analysis, in Section 5.3, we study whether less aggressive optimizations at each level, which impose less overheads, can be combined to provide an effective means to reduce the guardband.

O O O O O O O O B O O O O B O O O O O O O B O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O B O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Teapot: a domain-specific language for writing cache coherence protocols AbstractÐIn this paper, we describe Teapot, a domain-specific language for writing cache coherence protocols. Cache coherence is of concern when parallel and distributed systems make local replicas of shared data to improve scalability and performance. In both distributed shared memory systems and distributed file systems, a coherence protocol maintains agreement among the replicated copies as the underlying data are modified by programs running on the system. Cache coherence protocols are notoriously difficult to implement, debug, and maintain. Moreover, protocols are not off-the-shelf, reusable components, because their details depend on the requirements of the system under consideration. The complexity of engineering coherence protocols can discourage users from experimenting with new, potentially more efficient protocols. We have designed and implemented Teapot, a domain-specific language that attempts to address this complexity. Teapot's language constructs, such as a state-centric control structure and continuations, are better suited to expressing protocol code than those of a typical systems programming language. Teapot also facilitates automatic verification of protocols, so hard to find protocol bugs, such as deadlocks, can be detected and fixed before encountering them on an actual execution. We describe the design rationale of Teapot, present an empirical evaluation of the language using two case studies, and relate the lessons that we learned in building a domain-specific language for systems programming. The Teapot work most closely resembles the PCS system by Uehara et al. at the University of Tokyo [21] . They described a framework for writing coherence protocols for distributed file system caching. Unlike Teapot, they use an interpreted language, thus compromising efficiency. Like Teapot, they write protocol handlers with blocking primitives and transform the program into a message-passing style. Our work differs in several aspects. Teapot's continuation-based semantic model is more general than PCS's, which is a message-driven interpretation of a protocol specification. PCS's application domain is less sensitive to protocol code efficiency, so they do not explore optimizations. Finally, we exploit verification technology by automatically generating an input specification for the MurÈ verification system. Synchronous programming languages, such as ESTEREL [22] and the Statecharts formalism [23] , are useful for describing reactive systems and real-time applications. The most important commonality between these programming languages and Teapot is that they all are ways of expressing complicated finite-state machines more intuitively than a flat automaton. They all support some mechanism for composing smaller, simpler state machines at the language level. A compiler then converts this composition into a flat automaton, which the programmer never has to deal with directly. ESTEREL supports decomposition of a larger state machine into smaller, concurrently running state machines that communicate synchronously. Statecharts support the notions of depth and orthogonality to build large state machines out of smaller ones. Teapot manages the crossproduct interaction (and the resulting state-space bloat) of explicit protocol states and pending events by factoring the pending events into states implicit in the continuation stack. Teapot shares another feature with ESTEREL and Statecharts in its support for automatic verification.. Teapot also differs significantly from synchronous languages in many important respects. A key distinction between Teapot and ESTEREL is that ESTEREL always describes finite state machines. Conceptually, Teapot continuations can be nested dynamically to arbitrary levels, and therefore Teapot programs are not equivalent to finite state machines. 9 Similarly, Teapot queues are not bounded a priori. A bounded nesting of continuations can easily be simulated in ESTEREL by an appropriate sequencing of signals between interacting state machines. In our experience, most protocols can be written in a way that statically limits the nesting of continuations, so the ESTEREL is expressive enough in this regard; Teapot's execution model simply does not require the boundedness. Queuing, being inherently an asynchronous operation, is more complicated for ESTEREL. An ESTEREL program would have to simulate all possible states of a queue to some limited length, a cumbersome programming effort. On the other hand, ESTEREL handles nondeterminacy in the ordering of events in a cleaner manner than Teapot. For example, suppose a node is waiting on two messages, A and B, in either order. Teapot will have to explicitly code the possibility of A arriving before B, and of B arriving before A. This can be handled more conveniently using ESTEREL's parallel composition.. Teapot differs from synchronous languages in several other respects. It does not have a notion of time, so it is not suitable for programming real-time applications. The notion of concurrency in synchronous languages is different from that in Teapot. In synchronous languages, logical concurrency of state machines is a vehicle for expressing 9 . Note that the model that is constructed for verification purposes will have to bound such dynamic behavior, as the model checker checks only a finite state space. It is the actual execution that need not be bounded a priori.. interacting subcomponents; such concurrency is later compiled away to obtain a single-thread program. A Teapot program logically specifies only one state machine. The need for concurrency arises because several such programs are required to run on the same processing resourceÐthey have to interleave their execution (essentially as coroutines).. Wing et al. [24] present an eloquent case for using modelchecking technology with complex software systems, such as a distributed file system coherence protocols. We also use model checking technology, but our primary focus is on a language for writing coherence protocols, and on deriving executable code as well as the verification system input from a single source. They write the input to the model checker separately from their code, which introduces the possibility of errors.. The design and implementation of domain-specific languages has spurred considerable interest in the systems programming community. Recent work includes instruction-set description languages [25] [26], a specification language for automatically generating network packet filters [27] , and compiler optimizations for interface description languages [28] .

O O O O O O B I O O O O O O O O O O O O B I O B I O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Duality, achievable rates, and sum-rate capacity of Gaussian MIMO broadcast channels Abstract-We consider a multi-user multiple input multiple output (MIMO) Gaussian broadcast channel (BC), where the transmitter and receivers have multiple antennas. Since the MIMO broadcast channel is in general a non-degraded broadcast channel, its capacity region remains an unsolved problem. In this paper, we establish a duality between what is termed the "dirty paper" achievable region (the Caire-Shamai achievable region) for the MIMO broadcast channel and the capacity region of the MIMO multiple-access channel (MAC), which is easy to compute. Using this duality, we greatly reduce the computational complexity required for obtaining the dirty paper achievable region for the MIMO BC. We also show that the dirty paper achievable region achieves the sum-rate capacity of the MIMO BC by establishing that the maximum sum rate of this region equals an upper-bound on the sum rate of the MIMO BC. Multiple input multiple output (MIMO) systems have received a great deal of attention as a method to achieve very high data rates over wireless links. The capacity of single-user MIMO Gaussian channels was first studied by Foschini [1] and Telatar [2] . This work has also been extended to the MIMO multiple-access channel (MAC) [2] [3] [4] . The capacity of MIMO broadcast channels (BC), however, is an open problem due to the lack of a general theory on non-degraded broadcast channels. In pioneering work by Caire and Shamai [5] , a set of achievable rates (the achievable region) for the MIMO broadcast channel was obtained by applying the "dirty paper" result [6] at the transmitter (or alternatively coding for non-causally known interference). It was also shown in [5, 7] that the sum rate MIMO BC capacity equals the maximum sum rate of this achievable region for the two user broadcast channel with an arbitrary number of transmit antennas ( In this paper, we established a duality relationship between two seemingly unrelated regions: the achievable region of the MIMO BC obtained using the dirty paper coding and the capacity region of the MIMO MAC. This duality allows us to easily find the dirty paper achievable region and the dirty paper covariance matrices which achieve the boundary of this region. Though the capacity region of the MIMO BC is unknown due to its non-degraded nature, we were able to show that the dirty paper achievable region achieves the sum rate capacity of the MIMO BC through use of the MAC-BC duality and the Sato upper bound. These results open up the possibility that the dirty paper region is the actual capacity region of the MIMO BC and also the possibility that other instances of duality exist in Gaussian multi-terminal networks. To obtain our results, we use the achievable region of the MIMO BC channel obtained in [5, 8] and results on the MIMO MAC capacity region [2] [3] [4] extensively in this paper. Hence, we first summarize these results and then state results on the duality of the scalar Gaussian BC and MAC [9] .

B O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O B I I O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O


Exploiting site-level information to improve web search Ranking Web search results has long evolved beyond simple bag-of-words retrieval models. Modern search engines routinely employ machine learning ranking that relies on exogenous relevance signals. Yet the majority of current methods still evaluate each Web page out of context. In this work, we introduce a novel source of relevance information for Web search by evaluating each page in the context of its host Web site. For this purpose, we devise two strategies for compactly representing entire Web sites. We formalize our approach by building two indices, a traditional page index and a new site index, where each "document" represents the an entire Web site. At runtime, a query is first executed against both indices, and then the final page score for a given query is produced by combining the scores of the page and its site. Experimental results carried out on a large-scale Web search test collection from a major commercial search engine confirm the proposed approach leads to consistent and significant improvements in retrieval effectiveness. Modern Web search engines routinely crawl and analyze tens of billions of Web pages, yet finding highly relevant results for every query remains a major challenge. Conventionally, Web search is performed in two phases. The first phase, usually implemented as a variant of the bag-of-words approach, seeks high recall and retrieves a set of candidate documents, which contain all the query words. The second retrieval phase seeks high precision by reranking the candidate pages using machine learning techniques that rely on a much larger feature set, including numerous sources of exogenous knowledge. Over the recent years, the learning to rank approach has become a standard technique in many IR Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. To copy otherwise, to republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. tasks beyond Web search, yet one thing remained constantranking generally evaluates each document in isolation.. We believe this approach to be quite limiting in Web search, as it overlooks the information encoded in the organization of pages on the Web. Admittedly, existing approaches do incorporate some information collected from the network of hyperlinks, namely, by employing link analysis algorithms such as PageRank [2] or HITS [7] , and by aggregating anchor text of incoming links to each page [12] . However, even after augmentation with such external evidence, each page is essentially scored by disregarding its context.. We propose an extension to the existing methods so that each page is considered in its natural context, namely, in the context of its host Web site. In particular, we believe this approach allows us to better identify the parts of the page that are truly representative of its content, as well as those "incidental" parts that can be ignored. Conceptually, our method can be viewed as complementary to PageRankstyle graph algorithms. Whereas the latter boost individual page scores based on the overall network prominence of the Web site, our method incorporates textual clues that cannot be captured through link analysis alone. The proposed approach can also help overcome anchor text sparsity. While anchor text has been shown to be a strong relevance signal, many pages have no meaningful incoming anchor text. Aggregating the anchor text at the site level allows for cross-use of anchor text for multiple pages of the same site.. Naturally, indiscriminate aggregation of content over entire Web sites might overshadow key nuggets of information in individual pages, thus ruining the ranking. One could envision multiple ways to incorporate site-level information into the ranking process. One way to do so, which is reminiscent of the traditional page-level ranking, is to use the site information to augment the page representation. A notable drawback of this approach, however, is that the page index becomes prohibitively large owing to massive text duplication, as the site text is added to each page from the site. To this end, we adopted an alternative approach where we maintain two indices: a traditional URL index (page index), and a separate (and much smaller) site index. The latter index is populated with site representations, which succinctly represent the content of the entire site. Each page is scored with respect to both indices, and the resulting scores are combined and used for ranking. This two-index approach provides an efficient and effective way to augment the page ranking process with site information without having to replicate the expansion data for each page in the index.. The contributions of this paper are threefold. First, we propose a novel search paradigm, which combines evidence from a traditional Web page-based index as well as a sitebased index. The site index helps improve retrieval effectiveness by providing more contextually relevant information for the pages. Second, we describe two novel approaches for representing the site content. We do so by using the information external to the site (i.e., the incoming anchor text) and internal to the site (i.e., a sample of the site's own pages). Finally, we perform an empirical evaluation of the proposed approach using a large test collection from a major commercial Web search engine. Experimental results show that our approach leads to significant improvements in retrieval effectiveness. We presented a novel methodology for improving Web search relevance using site-level information. Our approach uses a site index in addition to a traditional URL index for Web search ranking. We described two strategies for representing and indexing Web sites. We also evaluated the effectiveness of combining evidence from the site index with the URL index using a sophisticated text-only ranking function. Our experiments were carried out over a very large Web search test collection from a major commercial search engine. The results showed that using site-level information can consistently and significantly improve Web search effectiveness.. As part of future work, we are interested in exploring different strategies for sampling URLs from sites beyond the simple approach used in this study. We would also like to investigate additional site-level features that could be computed using the site index. Finally, we believe it is important to develop a better understanding of the role of site cohesiveness within our framework, especially for the anchor text site index. There are two main lines of research most closely related to our work. The first body of research has investigated ways of imposing implicit structure on corpora that are not explicitly structured (e.g., news corpora). Most of the proposed approaches rely on clustering to define the implicit structure. One of the first approaches, by Jardine and van Rijsbergen [5] , clustered documents using agglomerative clustering. The more recent approaches developed by Liu and Croft [9] and Kurland and Lee [8] cluster documents using K-means clustering. After the entire corpus has been clustered, document term weights are computed using document, cluster, and corpus statistics. In these approaches, term weights reflect the importance of the term in the context of the document itself, the context of similar documents, or the corpus as a whole. Other strategies for imposing implicit corpus structure to improve search relevance have been proposed as well, such as using topic modeling [15] . Although using implicit structure for textual matching has been shown to be useful by various researchers, it is infeasible to apply such methods to large collections, such as the Web, primarily due to the prohibitive cost of clustering billions of documents.. The other line of research looked at ways for improving search relevance using explicit corpus structure. As we mentioned before, not all document collections are structured, but for those that are, there are certain benefits to using this explicit structure. The key benefit of such approaches is that clustering is not necessary, and that explicit corpus structure is likely to be more accurate and more useful than implicitly defined structure. Most of the research in this direction used the link structure of the Web to develop improved textual matching strategies. Qin et al. [13] , Shakery and Zhai [14] , and Metzler et al. [12] proposed methods for propagating text matching scores and textual representation across the Web graph. However, such methods suffer from limited coverage due to properties of the Web graph. For example, the anchor text aggregation method proposed by Metzler et al. only covers about 5% of all URLs [12] , whereas our proposed approach has the ability to cover 100% of URLs.. Finally, in work that is perhaps the most closely related to ours, Aguiar [1] proposed building two indices, one for pages and another for the context of the pages, where the context is defined using text and link similarity. The latter work is similar to our proposed method in its use of the page context; however, our approaches differ in the way this context is defined. Specifically, we build a site index, which is conceptually more straightforward and less computationally demanding to build and manage than the contextual index proposed by Aguiar. Furthermore, Aguiar's use of text and link similarity is reminiscent of discovering imprecise implicit structure. In contrast, our method uses Web sites as the most natural context of Web pages.

O O O O O B I O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O