This paper presents a certification mechanism for verifying the secure flow of information through a program. Because it exploits the properties of a lattice structure among security classes, the procedure is sufficiently simple that it can easily be included in the analysis phase of most existing compilers. Appropriate semantics are presented and proved correct. An important application is the confinement problem: The mechanism can prove that a program cannot cause supposedly nonconfidential results to depend on confidential input data.

Addressing unresolved questions concerning computational thinking.

Queueing network models have proved to be cost effectwe tools for analyzing modern computer systems. This tutorial paper presents the basic results using the operational approach, a framework which allows the analyst to test whether each assumption is met in a given system. The early sections describe the nature of queueing network models and their apphcations for calculating and predicting performance quantitms The basic performance quantities--such as utilizations, mean queue lengths, and mean response tunes--are defined, and operatmnal relationships among them are derwed Following this, the concept of job flow balance is introduced and used to study asymptotic throughputs and response tunes. The concepts of state transition balance, one-step behavior, and homogeneity are then used to relate the proportions of time that each system state is occupied to the parameters of job demand and to dewce charactenstms Efficmnt methods for computing basic performance quantities are also described. Finally the concept of decomposition is used to stmphfy analyses by replacing subsystems with equivalent devices. All concepts are illustrated liberally with examples

If we are not careful, our fascination with "computational thinking" may lead us back into the trap we are trying to escape.

No abstract

No abstract

No abstract

A program's working set is the collection of segments (or pages) recently referenced. This concept has led to efficient methods for measuring a program's intrinsic memory demand; it has assisted in understanding and in modeling program behavior; and it has been used as the basis of optimal multiprograrnmed memory management. The total cost of a working set dispatcher is no larger than the total cost of other common dispatchers. This paper outlines the argument why it is unlikely that anyone will find a cheaper nonlookahead~emory policy that delivers significantly better performance.Index Terms \'lorking sets, memory management. virtual memory, multiprogramming, optimal multiprogramming, lifetime curves, program measureI'lent, program behavior. stochastic program models, phase/transition behavior. program locality, multiprogrammed load control1ers.~ispatchers,working set dispatchers, memor/ space-time product.*I'lork reported herein \'1as supported in part by NSF Grants GJ-41289 and~ICS78-01729 at Purdue University. A condensed, preliminary draft of this paper was presented as an invited lecture at the International Symposium on Operating Systems, IRIA Laboria, Rocquenc:ourt, France, October 2-4, 1978 [DENN78d). Few yet suspected that strong coupling between memory and CPU scheduling is essential --the prevailing view was that the successful multilevel feedback queue of the Compatible Time Sharing System (CTSS) would be used to feed jobs into the multiprogramming mix, where they would then neatly be managed by an appropriate references; thus t = 1,2,3, .•. measures the program's internalIIvirtual time" or "process time".A resident set is the subset of all the program's segments present in the main memory at a given time. If the reference rCt)is not in the'resident set established at time t-l, a segment (or page) fault occurs at time t. '!his fault interrupts the program until the missing segment can be loaded in the resident set.Segments made resident by the fault mechanism are "loaded on demand ll (others are "preloadedll).The memory policies of interest here determine the content of the resident set by loading segments on demand and then deciding when to remove them. ized to a set of parameters --e.g., a separate parameter for each segment --but no one has found a mutliple parameter policy that improves significantly over all single parameter policies.The performance of a memoIY policy can be expressed through its swapping curve, which is a function f relating the rate of segment faults to the size of the resident set. A fixed-space memory policy, a concept usually restricted to paging, intetprets the control parameter e as the size of the resident set; in this case the swapping curve f(6) specifies the corresponding Tate of page faults. A variable-space memory policy uses the control parameter B to determine a bound on the residence times of segments.Thus a value of B implicitly determines a mean resident set size x, and also a rate of segment faults y; the swapping curve, y = f(x), is determined pa...