111397
Point-versus interval-based temporal data models
The association of timestamps with various data items such as tuples or attribute values is fundamental to the management of time varying information. Using intervals in timestamps, as do most data models, leaves a data model with a variety of choices for giving a meaning to timestamps. Specifically, some such data models claim to be point based while other data models claim to be interval based. The meaning chosen for timestamps is important it has a pervasive effect on most aspects of a data model, including database design, a variety of query language properties, and query processing techniques, e.g., the availability of query optimization opportunities. The paper precisely defines the notions of point based and interval based temporal data models, thus providing a new formal basis for characterizing temporal data models and obtaining new insights into the properties of their query languages. Queries in point based models treat snapshot equivalent argument relations identically. This renders point based models insensitive to coalescing. In contrast, queries in interval based models give significance to the actual intervals used in the timestamps, thus generally treating non identical, but possibly snapshot equivalent relations differently. The paper identifies the notion of time fragment preservation as the essential defining property of an interval based data model.
1723263
Multidimensional data modeling for location-based services
Abstract.With the recent and continuing advances in areas such as wireless communications and positioning technologies, mobile, location-based services are becoming possible.Such services deliver location-dependent content to their users. More specifically, these services may capture the movements and requests of their users in multidimensional databases, i.e., data warehouses, and content delivery may be based on the results of complex queries on these data warehouses. Such queries aggregate detailed data in order to find useful patterns, e.g., in the interaction of a particular user with the services.The application of multidimensional technology in this context poses a range of new challenges. The specific challenge addressed here concerns the provision of an appropriate multidimensional data model. In particular, the paper extends an existing multidimensional data model and algebraic query language to accommodate spatial values that exhibit partial containment relationships instead of the total containment relationships normally assumed in multidimensional data models. Partial containment introduces imprecision in aggregation paths. The paper proposes a method for evaluating the imprecision of such paths. The paper also offers transformations of dimension hierarchies with partial containment relationships to simple hierarchies, to which existing precomputation techniques are applicable.
45102117
Temporal specialization
The authors explore a variety of temporal relations with specialized relationships between transaction and valid time. An example is a retroactive temporal event relation, where the event must have occurred before it was stored, i.e., the valid time-stamp is restricted to be less than the transaction time-stamp. The authors discuss many useful restrictions, defining a large number of specialized types of temporal relations, and indicate some of their applications. A detailed taxonomy of specialized temporal relations is presented. This taxonomy may be used during database design to specify the particular time semantics of temporal relations.<<ETX>>
1655888
Supporting imprecision in multidimensional databases using granularities
Online analytical processing (OLAP) technologies are being used widely, but the lack of effective means of handling data imprecision, which occurs when exact values are not known precisely or are entirely missing, represents a major obstacle in applying these technologies in many domains. The paper develops techniques for handling imprecision that aim to maximally reuse existing OLAP modeling constructs such as dimension hierarchies and granularities. With imprecise data available in the database, queries are tested to determine whether or not they may be answered precisely given the available data; if not, alternative queries unaffected by the imprecision are suggested. When processing queries affected by imprecision, techniques are proposed that take into account the imprecision in the grouping of the data, in the subsequent aggregate computation, and in the presentation of the imprecise result to the user. The approach is capable of exploiting existing OLAP query processing techniques such as pre-aggregation, yielding an effective approach with low computational overhead and that may be implemented using current technology.
44396365
Specification-based data reduction in dimensional data warehouses
Presents a powerful and easy-to-use technique for aggregation-based data reduction that enables the gradual change of the data from being detailed to being increasingly aggregated. The technique enables huge storage gains while retaining the data that is essential to the users, and it preserves the ability to query original and reduced data in an integrated manner.
1348801
Using differential technlques to efficiently support transaction time
We present an architecture for query processing in the relational model extended with transaction time. The architecture integrates standard query optimization and computation techniques with new differential computation techniques. Differential computation computes a query incrementally or decrementally from the cahced and indexed results of previous computations. The use of differential computation techniques is essential in order to provide efficient processing of queries that access very large temporal relations. Alternative query plans are integrated into a state transition network, where the state space includes backlogs of base relations, cached results from previous computations, a cache index, and intermediate results; the transitions include standard relational algebra operators, operators for constructing differential files, operators for differential computation, and combined operators. A rule set is presented to prune away parts of state transition networks that are not promising, and dynamic programming techniques are used to identify the optimal plans from the remaining state transition networks. An extended logical access path serves as a “structuring” index on the cached results and contains, in addition, vital statistics for the query optimization process (including statistics about base relations, backlogs, and queries-previously computed and cached, previously computed, or just previously estimated).
14146996
Cryptographic access control in a distributed file system
Traditional access control mechanisms rely on a reference monitor to mediate access to protected resources. Reference monitors are inherently centralized and existing attempts to distribute the functionality of the reference monitor suffer from problems of scalability.Cryptographic access control is a new distributed access control paradigm designed for a global federation of information systems. It defines an implicit access control mechanism, which relies exclusively on cryptography to provide confidentiality and integrity of data managed by the system. It is particularly designed to operate in untrusted environments where the lack of global knowledge and control are defining characteristics.The proposed mechanism has been implemented in a distributed file system, which is presented in this paper along with a preliminary evaluation of the proposed mechanism.
604106
Protection reconfiguration for reusable software
Secure distributed applications often include code to authenticate users, verify access rights, and establish secure communication channels between software components (e.g., clients and servers). This code is often specific to the application and to the context in which the application is used. Embedding protection definitions in the application code makes it difficult to reuse because different applications often have very different protection constraints. We argue that protection definitions should be specified separately from application code in order to facilitate protection reconfiguration and software reuse. This separation may be achieved by specifying protection definitions in a Protection Interface Definition Language, and is implemented by proxies installed between software components that are executing in different protection contexts (e.g., between client and server). Mechanisms for creation and dynamic installation of protection proxies have been implemented in a distributed shared memory system, and the viability of our solution is demonstrated by a simple name server, which is currently being reused in three different protection contexts.
2348538
Combating Spam with TEA
— It has been observed that the underlying reasons for the continuing growth of the " spam " problem are a lack of reliable sender authentication and the near-zero cost of sending huge volumes of marketing material worldwide, via email. Previous attempts to address these problems either change the fundamental properties of email, reducing its usefulness to legitimate senders, or require an infeasible move to new system architectures. In this paper we present two new techniques for increasing the level of sender authentication for legacy-system plain text email addresses. We then show how these Trustworthy Email Addresses (TEA) can be used in conjunction with a trust and risk-based security framework as an effective anti-spam tool. Our prototype Java implementation is then evaluated in the context of a spammer threat model with an economic analysis of the viability of each threat.
8891155
The Claim Tool Kit for ad hoc recognition of peer entities
In ubiquitous/pervasive computing environments, it is envisaged that computing elements--entities--will start interacting in an ad hoc fashion. The peer-to-peer (p2p) paradigm is appealing for such types of interaction especially with JXTA, which supports the development of reusable p2p building blocks, which facilitate implementation on any smart device. However, the inability to rely on a centralised authentication infrastructure, the openness of the environment and the absence of an administrator (it is assumed to be too expensive to have a skilled administrator at hand due to the large number of peers) challenge the use of legacy authentication mechanisms.Supporting spontaneous interactions among previously unknown entities requires dynamic enrolment of strangers and unknown entities. Entity recognition (ER) is a process that is carried out each time an interaction happens between entities in order to dynamically recognise previously met entities.In this paper, we present the Claim Tool Kit (CTK), a Java-based implementation of ER: entities exchange messages, called Claims, and rely on their associated clues to evaluate the level of confidence in recognition.The CTK employs advanced features available with Java, such as JXTA and Java Cryptography and Security Architectures. We show that the CTK needs performance results on these features in order to increase the level of auto-configuration of the CTK. We describe how to obtain performance assessment for some of these new features. Finally, we explain how the CTK can be instrumented to take into account performance assessment. By analysing the evaluation results, the applicability of these advanced Java-based technologies for peer entity recognition is assessed.
14551885
A unified security framework for networked applications
Various security models have been proposed for different types of applications and numerous types of execution environments. These models are typically reinforced by adding code to the application, which authenticates principals, authorises operations and establishes secure communication among distributed software components (e.g., clients and servers). This code is often application and context-specific, which makes it difficult to integrate an application with other each other.In this paper we propose a new unified access control mechanism that supports most of the existing security models and offers a number of additional controls that are not normally provided by security mechanisms. Moreover, the proposed mechanism integrates well with existing programming paradigms for distributed application, e.g., client/server technology and component based programming. This means that it can be seamlessly integrated with most existing distributed applications. We have implemented the proposed mechanism in a framework, that can be instantiated to implement different security models and policies. We present a qualitative evaluation that demonstrates the framework's ability to support a wide range of security policies and a preliminary performance evaluation of the framework.