SAFE: A Declarative Trust-Agile System with Linked Credentials

Secure Access For Everyone (SAFE), is an integrated system for managing trust

using a logic-based declarative language. Logical trust systems authorize each

request by constructing a proof from a context---a set of authenticated logic

statements representing credentials and policies issued by various principals

in a networked system. A key barrier to practical use of logical trust systems

is the problem of managing proof contexts: identifying, validating, and

assembling the credentials and policies that are relevant to each trust

decision.

SAFE addresses this challenge by (i) proposing a distributed authenticated data

repository for storing the credentials and policies; (ii) introducing a

programmable credential discovery and assembly layer that generates the

appropriate tailored context for a given request. The authenticated data

repository is built upon a scalable key-value store with its contents named by

secure identifiers and certified by the issuing principal. The SAFE language

provides scripting primitives to generate and organize logic sets representing

credentials and policies, materialize the logic sets as certificates, and link

them to reflect delegation patterns in the application. The authorizer fetches

the logic sets on demand, then validates and caches them locally for further

use. Upon each request, the authorizer constructs the tailored proof context

and provides it to the SAFE inference for certified validation.

Delegation-driven credential linking with certified data distribution provides

flexible and dynamic policy control enabling security and trust infrastructure

to be agile, while addressing the perennial problems related to today's

certificate infrastructure: automated credential discovery, scalable

revocation, and issuing credentials without relying on centralized authority.

We envision SAFE as a new foundation for building secure network systems. We

used SAFE to build secure services based on case studies drawn from practice:

(i) a secure name service resolver similar to DNS that resolves a name across

multi-domain federated systems; (ii) a secure proxy shim to delegate access

control decisions in a key-value store; (iii) an authorization module for a

networked infrastructure-as-a-service system with a federated trust structure

(NSF GENI initiative); and (iv) a secure cooperative data analytics service

that adheres to individual secrecy constraints while disclosing the data. We

present empirical evaluation based on these case studies and demonstrate that

SAFE supports a wide range of applications with low overhead.

Dynamics of the Disk-Pendulum Coupled System With Vertical Excitation

This paper investigates the static and dynamic characteristics of the semi-elliptical rocking disk on which a pendulum pinned. This coupled system’s response is also analyzed analytically and numerically when a vertical harmonic excitation is applied to the bottom of the rocking disk. Lagrange’s Equation is used to derive the motion equations of the disk-pendulum coupled system. The second derivative test for the system’s potential energy shows how the location of the pendulum’s pivotal point affects the number and stability of equilibria, and the change of location presents different bifurcation diagrams for different geometries of the rocking disk. For both vertically excited and unforced cases, the coupled system shows chaos easily, but the proper chosen parameters can still help the system reach and keep the steady state. For the steady state of the vertically excited rocking disk without a pendulum, the variation of the excitation’s amplitude and frequency result in the hysteresis for the amplitude of the response. When a pendulum is pinned on the rocking disk, three major categories of steady states are presently in the numerical way.

Experimental Study of Storage Ring Free-Electron Laser with Novel Capabilities

The Duke Free-electron laser (FEL) system, driven by the Duke electron storage ring, has been at the forefront of developing new light source capabilities over the past two decades. In 1999, the Duke FEL demonstrated the first lasing of a storage ring FEL in the vacuum ultraviolet (VUV) region at $194$ nm using two planar OK-4 undulators. With two helical undulators added to the outboard sides of the planar undulators, in 2005 the highest FEL gain ($47.8\%$) of a storage ring FEL was achieved using the Duke FEL system with a four-undulator configuration. In addition, the Duke FEL has been used as the photon source to drive the High Intensity $\gamma$-ray Source (HIGS) via Compton scattering of the FEL beam and electron beam inside the FEL cavity. Taking advantage of FEL's wavelength tunability as well as the adjustability of the energy of the electron beam in the storage ring, the nearly monochromatic $\gamma$-ray beam has been produced in a wide energy range from $1$ to $100$ MeV at the HIGS. To further push the FEL short wavelength limit and enhance the FEL gain in the VUV regime for high energy $\gamma$-ray production, two additional helical undulators were installed in 2012 using an undulator switchyard system to allow switching between the two planar and two helical undulators in the middle section of the FEL system. Using different undulator configurations made possible by the switchyard, a number of novel capabilities of the storage ring FEL have been developed and exploited for a wide FEL wavelength range from infrared (IR) to VUV. These new capabilities will eventually be made available to the $\gamma$-ray operation, which will greatly enhance the $\gamma$-ray user research program, creating new opportunities for certain types of nuclear physics research.

With the wide wavelength tuning range, the FEL is an intrinsically well-suited device to produce lasing with multiple colors. Taking advantage of the availability of an undulator system with multiple undulators, we have demonstrated the first two-color lasing of a storage ring FEL. Using either a three- or four-undulator configuration with a pair of dual-band high reflectivity mirrors, we have achieved simultaneous lasing in the IR and UV spectral regions. With the low-gain feature of the storage ring FEL, the power generated at the two wavelengths can be equally built up and precisely balanced to reach FEL saturation. A systematic experimental program to characterize this two-color FEL has been carried out, including precise power control, a study of the power stability of two-color lasing, wavelength tuning, and the impact of the FEL mirror degradation. Using this two-color laser, we have started to develop a new two-color $\gamma$-ray beam for scientific research at the HIGS.

Using the undulator switchyard, four helical undulators installed in the beamline can be configured to not only enhance the FEL gain in the VUV regime, but also allow for the full polarization control of the FEL beams. For the accelerator operation, the use of helical undulators is essential to extend the FEL mirror lifetime by reducing radiation damage from harmonic undulator radiation. Using a pair of helical undulators with opposite helicities, we have realized (1) fast helicity switching between left- and right-circular polarizations, and (2) the generation of fully controllable linear polarization. In order to extend these new capabilities of polarization control to the $\gamma$-ray operation in a wide energy range at the HIGS, a set of FEL polarization diagnostic systems need to be developed to cover the entire FEL wavelength range. The preliminary development of the polarization diagnostics for the wavelength range from IR to UV has been carried out.