Platform Architectures for Policy-Based Network Access Control

Tämä diplomityö käsittelee sääntöpohjaisen verkkoon pääsyn hallinnan (NAC) ratkaisuja arkkitehtonisesta näkökulmasta. Työssä käydään läpi Trusted Computing Groupin, Microsoft Corporationin, Juniper Networksin sekä Cisco Systemsin NAC-ratkaisuja. NAC koostuu joukosta uusia sekä jo olemassa olevia teknologioita, jotka auttavat ennalta määriteltyyn sääntökantaan perustuen hallitsemaan suojattuun verkkoon pyrkivien laitteiden tietoliikenneyhteyksiä. Käyttäjän tunnistamisen lisäksi NAC pystyy rajoittamaan verkkoon pääsyä laitekohtaisten ominaisuuksien perusteella, esimerkiksi virustunnisteisiin ja käyttöjärjestelmäpäivityksiin liittyen ja paikkaamaan tietyin rajoituksin näissä esiintyviä puutteita verkkoon pääsyn sallimiseksi. NAC on verraten uusi käsite, jolta puuttuu tarkka määritelmä. Tästä johtuen nykymarkkinoilla myydään ominaisuuksiltaan puutteellisia tuotteita NAC-nimikkeellä. Standardointi eri valmistajien NAC-komponenttien yhteentoimivuuden takaamiseksi on meneillään, minkä perusteella ratkaisut voidaan jakaa joko avoimia standardeja tai valmistajakohtaisia standardeja noudattaviksi. Esitellyt NAC-ratkaisut noudattavat standardeja joko rajoitetusti tai eivät lainkaan. Mikään läpikäydyistä ratkaisuista ei ole täydellinen NAC, mutta Juniper Networksin ratkaisu nousee niistä potentiaalisimmaksi jatkokehityksen ja -tutkimuksen kohteeksi TietoEnator Processing & Networks Oy:lle. Eräs keskeinen ongelma NAC-konseptissa on työaseman tietoverkolle toimittama mahdollisesti valheellinen tietoturvatarkistuksen tulos, minkä perusteella pääsyä osittain hallitaan. Muun muassa tähän ongelmaan ratkaisuna voisi olla jo nykytietokoneista löytyvä TPM-siru, mikä takaa tiedon oikeellisuuden ja koskemattomuuden.

A System-Level Simulation Model for a Protocol Processor

As the development of integrated circuit technology continues to follow Moore’s law the complexity of circuits increases exponentially. Traditional hardware description languages such as VHDL and Verilog are no longer powerful enough to cope with this level of complexity and do not provide facilities for hardware/software codesign. Languages such as SystemC are intended to solve these problems by combining the powerful expression of high level programming languages and hardware oriented facilities of hardware description languages. To fully replace older languages in the desing flow of digital systems SystemC should also be synthesizable. The devices required by modern high speed networks often share the same tight constraints for e.g. size, power consumption and price with embedded systems but have also very demanding real time and quality of service requirements that are difficult to satisfy with general purpose processors. Dedicated hardware blocks of an application specific instruction set processor are one way to combine fast processing speed, energy efficiency, flexibility and relatively low time-to-market. Common features can be identified in the network processing domain making it possible to develop specialized but configurable processor architectures. One such architecture is the TACO which is based on transport triggered architecture. The architecture offers a high degree of parallelism and modularity and greatly simplified instruction decoding. For this M.Sc.(Tech) thesis, a simulation environment for the TACO architecture was developed with SystemC 2.2 using an old version written with SystemC 1.0 as a starting point. The environment enables rapid design space exploration by providing facilities for hw/sw codesign and simulation and an extendable library of automatically configured reusable hardware blocks. Other topics that are covered are the differences between SystemC 1.0 and 2.2 from the viewpoint of hardware modeling, and compilation of a SystemC model into synthesizable VHDL with Celoxica Agility SystemC Compiler. A simulation model for a processor for TCP/IP packet validation was designed and tested as a test case for the environment.

Test automation of digital mammography device

Testing of a complex software is time consuming. Automated tools are available quite a lot for desktop applications, but for embedded systems a custom-made tool is required Building a complete test framework is a complicated task. Therefore, the test platform was built on top of an already existing tool, CANoe. CANoe is a tool for CAN bus analysis and node simulation. The functionality of CANoe was extended with LabVIEW DLL. The LabVIEW software was used for simulating hardware components of the embedded device As a result of the study, a platform was created where tests could be automated. Of the current test plan, 10 percent were automated and up to 60 percent could be automated with the current functionality.

Operational Reliability Analysis of a Three-Tiered Thin-Client ERP-system in an International Corporate Environment

Internationalization and the following rapid growth have created the need to concentrate the IT systems of many small-to-medium-sized production companies. Enterprise Resource Planning systems are a common solution for such companies. Deployment of these ERP systems consists of many steps, one of which is the implementation of the same shared system at all international subsidiaries. This is also one of the most important steps in the internationalization strategy of the company from the IT point of view. The mechanical process of creating the required connections for the off-shore sites is the easiest and most well-documented step along the way, but the actual value of the system, once operational, is perceived in its operational reliability. The operational reliability of an ERP system is a combination of many factors. These factors vary from hardware- and connectivity-related issues to administrative tasks and communication between decentralized administrative units and sites. To accurately analyze the operational reliability of such system, one must take into consideration the full functionality of the system. This includes not only the mechanical and systematic processes but also the users and their administration. All operational reliability in an international environment relies heavily on hardware and telecommunication adequacy so it is imperative to have resources dimensioned with regard to planned usage. Still with poorly maintained communication/administration schemes no amount of bandwidth or memory will be enough to maintain a productive level of reliability. This thesis work analyzes the implementation of a shared ERP system to an international subsidiary of a Finnish production company. The system is Microsoft Dynamics Ax, currently being introduced to a Slovakian facility, a subsidiary of Peikko Finland Oy. The primary task is to create a feasible base of analysis against which the operational reliability of the system can be evaluated precisely. With a solid analysis the aim is to give recommendations on how future implementations are to be managed.

A Co-Processor Approach for Efficient Java Execution in Embedded Systems

This thesis deals with a hardware accelerated Java virtual machine, named REALJava. The REALJava virtual machine is targeted for resource constrained embedded systems. The goal is to attain increased computational performance with reduced power consumption. While these objectives are often seen as trade-offs, in this context both of them can be attained simultaneously by using dedicated hardware. The target level of the computational performance of the REALJava virtual machine is initially set to be as fast as the currently available full custom ASIC Java processors. As a secondary goal all of the components of the virtual machine are designed so that the resulting system can be scaled to support multiple co-processor cores. The virtual machine is designed using the hardware/software co-design paradigm. The partitioning between the two domains is flexible, allowing customizations to the resulting system, for instance the floating point support can be omitted from the hardware in order to decrease the size of the co-processor core. The communication between the hardware and the software domains is encapsulated into modules. This allows the REALJava virtual machine to be easily integrated into any system, simply by redesigning the communication modules. Besides the virtual machine and the related co-processor architecture, several performance enhancing techniques are presented. These include techniques related to instruction folding, stack handling, method invocation, constant loading and control in time domain. The REALJava virtual machine is prototyped using three different FPGA platforms. The original pipeline structure is modified to suit the FPGA environment. The performance of the resulting Java virtual machine is evaluated against existing Java solutions in the embedded systems field. The results show that the goals are attained, both in terms of computational performance and power consumption. Especially the computational performance is evaluated thoroughly, and the results show that the REALJava is more than twice as fast as the fastest full custom ASIC Java processor. In addition to standard Java virtual machine benchmarks, several new Java applications are designed to both verify the results and broaden the spectrum of the tests.

Trigger and data link system for CMS Resistive Plate Chambers at the LHC accelerator

The purpose of the work was to realize a high-speed digital data transfer system for RPC muon chambers in the CMS experiment on CERN’s new LHC accelerator. This large scale system took many years and many stages of prototyping to develop, and required the participation of tens of people. The system interfaces to Frontend Boards (FEB) at the 200,000-channel detector and to the trigger and readout electronics in the control room of the experiment. The distance between these two is about 80 metres and the speed required for the optic links was pushing the limits of available technology when the project was started. Here, as in many other aspects of the design, it was assumed that the features of readily available commercial components would develop in the course of the design work, just as they did. By choosing a high speed it was possible to multiplex the data from some the chambers into the same fibres to reduce the number of links needed. Further reduction was achieved by employing zero suppression and data compression, and a total of only 660 optical links were needed. Another requirement, which conflicted somewhat with choosing the components a late as possible was that the design needed to be radiation tolerant to an ionizing dose of 100 Gy and to a have a moderate tolerance to Single Event Effects (SEEs). This required some radiation test campaigns, and eventually led to ASICs being chosen for some of the critical parts. The system was made to be as reconfigurable as possible. The reconfiguration needs to be done from a distance as the electronics is not accessible except for some short and rare service breaks once the accelerator starts running. Therefore reconfigurable logic is extensively used, and the firmware development for the FPGAs constituted a sizable part of the work. Some special techniques needed to be used there too, to achieve the required radiation tolerance. The system has been demonstrated to work in several laboratory and beam tests, and now we are waiting to see it in action when the LHC will start running in the autumn 2008.

Defining a framework model to determine total costs of managed desktops using ITIL best practices

In modern day organizations there are an increasing number of IT devices such as computers, mobile phones and printers. These devices can be located and maintained by using specialized IT management applications. Costs related to a single device accumulate from various sources and are normally categorized as direct costs like hardware costs and indirect costs such as labor costs. These costs can be saved in a configuration management database and presented to users using web based development tools such as ASP.NET. The overall costs of IT devices during their lifecycle can be ten times higher than the actual purchase price of the product and ability to define and reduce these costs can save organizations noticeable amount of money. This Master’s Thesis introduces the research field of IT management and defines a custom framework model based on Information Technology Infrastructure Library (ITIL) best practices which is designed to be implemented as part of an existing IT management application for defining and presenting IT costs.

Error Modeling and Accuracy Analysis of a Novel Mobile Hybrid Parallel Robot

Over the last decades, calibration techniques have been widely used to improve the accuracy of robots and machine tools since they only involve software modification instead of changing the design and manufacture of the hardware. Traditionally, there are four steps are required for a calibration, i.e. error modeling, measurement, parameter identification and compensation. The objective of this thesis is to propose a method for the kinematics analysis and error modeling of a newly developed hybrid redundant robot IWR (Intersector Welding Robot), which possesses ten degrees of freedom (DOF) where 6-DOF in parallel and additional 4-DOF in serial. In this article, the problem of kinematics modeling and error modeling of the proposed IWR robot are discussed. Based on the vector arithmetic method, the kinematics model and the sensitivity model of the end-effector subject to the structure parameters is derived and analyzed. The relations between the pose (position and orientation) accuracy and manufacturing tolerances, actuation errors, and connection errors are formulated. Computer simulation is performed to examine the validity and effectiveness of the proposed method.

Toimittajien ja alihankkijoiden hyväksyntä projektiliiketoiminnassa

Työ on tehty Siemens Osakeyhtiön Logistiikka ja Osto yksik6ssa. Tavoitteena oli kartoittaa toimittajien hallintamallin toimivuutta sekä pyrkiä parantamaan toimittajien valintaa. Ostettaessa toimittajilta palveluita toteutettaviin projekteihin toimittajien hallintamalli toimii perustana sille, kuinka toimittaja valitaan ja mitä toimittajan valinnassa on otettava huomioon. Laadukkaaseen lopputulokseen pyrittäessä on erittäin tärkeää, että projektiin saadaan toimittaja, joka täyttää kaikki sille asetetut laadulliset, taloudelliset sekä tekniset vaatimukset. Työ pohjautuu teoriassa esitettyihin projektin määrittelemiseen, hankintatoimeen, toimittajien luokitteluun, yhteisty6n kehittämiseen sekä laatujohtamiseen. Työ toteutettiin haastattelututkimuksella, jossa haastateltiin Siemens Osakeyhtiön viiden eri toimialan projektipäällikköä. Tarkoituksena oli perehtyä toimialojen tapoihin hankkia toimittajia toteutettaviin projekteihin. Tutkimuksen pääpaino oli toimittajissa, jotka toteuttavat sdhk6asennuksia, kaytt6onottoa, suunnittelua, kokoonpanoa sekä rakentamista. Haastattelujen perusteella tutustuttiin toimialojen totutettuihin projekteihin, joita verrattiin haastattelusta saatuihin tuloksiin. Havaintojen perusteella annettiin kehitysehdotuksia, joilla kyettäisiin parantamaan toimittajien valintaa sekä toimittajien hallintamallia.

RTOS Framework for Real-Time Control System

This thesis is done as a complementary part for the active magnet bearing (AMB) control software development project in Lappeenranta University of Technology. The main focus of the thesis is to examine an idea of a real-time operating system (RTOS) framework that operates in a dedicated digital signal processor (DSP) environment. General use real-time operating systems do not necessarily provide sufficient platform for periodic control algorithm utilisation. In addition, application program interfaces found in real-time operating systems are commonly non-existent or provided as chip-support libraries, thus hindering platform independent software development. Hence, two divergent real-time operating systems and additional periodic extension software with the framework design are examined to find solutions for the research problems. The research is discharged by; tracing the selected real-time operating system, formulating requirements for the system, and designing the real-time operating system framework (OSFW). The OSFW is formed by programming the framework and conjoining the outcome with the RTOS and the periodic extension. The system is tested and functionality of the software is evaluated in theoretical context of the Rate Monotonic Scheduling (RMS) theory. The performance of the OSFW and substance of the approach are discussed in contrast to the research theme. The findings of the thesis demonstrates that the forged real-time operating system framework is a viable groundwork solution for periodic control applications.

Matkustajainformaatiojärjestelmän toteuttaminen junaan

Matkustajainformaatio junassa koostuu vaunujen ulkopuolisilla kylkinäytöillä esitettävistä junan lähtö-, väli- ja määräasematiedoista yhdessä junan ja vaunujen myyntinumeroiden kanssa sekä vaunujen sisäpuolella automaattisista kuulutuksista ja matkustamon näytöillä esitettävästä staattisesta ja vaihtuvasta informaatiosta. Työssä toteutetaan matkustajainformaatiojärjestelmä käytettäväksi matkustajunissa. Järjestelmään syötetään ennen matkan alkua junan tiedot, jonka jälkeen se toimii automaattisesti ilman tarvetta junahenkilökunnan toimenpiteille. Poikkeustilanteissa junahenkilökunta voi estää järjestelmän toiminnan tai valita esiohjelmointuja erikoiskuulutuksia. Toteuttamismenetelmäksi valittiin C-ohjelmointikieli Linux-käyttöjärjestelmällä varustetulla sulautetulla rautatiekäyttöön suunnitellulla laitealustalla.

The Detector Control Systems for the CMS Resistive Plate Chamber at LHC

The RPC Detector Control System (RCS) is the main subject of this PhD work. The project, involving the Lappeenranta University of Technology, the Warsaw University and INFN of Naples, is aimed to integrate the different subsystems for the RPC detector and its trigger chain in order to develop a common framework to control and monitoring the different parts. In this project, I have been strongly involved during the last three years on the hardware and software development, construction and commissioning as main responsible and coordinator. The CMS Resistive Plate Chambers (RPC) system consists of 912 double-gap chambers at its start-up in middle of 2008. A continuous control and monitoring of the detector, the trigger and all the ancillary sub-systems (high voltages, low voltages, environmental, gas, and cooling), is required to achieve the operational stability and reliability of a so large and complex detector and trigger system. Role of the RPC Detector Control System is to monitor the detector conditions and performance, control and monitor all subsystems related to RPC and their electronics and store all the information in a dedicated database, called Condition DB. Therefore the RPC DCS system has to assure the safe and correct operation of the sub-detectors during all CMS life time (more than 10 year), detect abnormal and harmful situations and take protective and automatic actions to minimize consequential damages. The analysis of the requirements and project challenges, the architecture design and its development as well as the calibration and commissioning phases represent themain tasks of the work developed for this PhD thesis. Different technologies, middleware and solutions has been studied and adopted in the design and development of the different components and a big challenging consisted in the integration of these different parts each other and in the general CMS control system and data acquisition framework. Therefore, the RCS installation and commissioning phase as well as its performance and the first results, obtained during the last three years CMS cosmic runs, will be

Improving Cross Direction Basis Weight Profile in a Fourdrinier Paper Machine

The purpose of this study was to improve PM7’s basis weight CD profile in Stora Enso’s Berghuizer mill and to search mechanical defects which affect to the formation of the basis weight CD profile. In the theoretical part PM7’s structure was presented and the formation of the basis weight and caliper CD profiles was examined as well as disturbances which are affecting to the formation. The function of the control system was scrutinised for the side of CD profiles as well as the formation of the measured CD profiles. Tuning of the control system was examined through the response model and filtering. Specification of the response model and filtering was explained and how to determine 2sigma statistical number. In the end of the theoretical part ATPA hardware and a new profile browser were introduced. In the experimental part focus was in the beginning to search and remove mechanical defects which are affecting to CD profiles. The next step was to verify the reliability of the online measurements, to study the stability of the basis weight CD profile and to find out so called fingerprint, a basis weight CD profile which is unique for each paper machine. New response model and filtering value for basis weight CD profile was determined by bump tests. After a follow up period the affect of the new response model and filtering was analysed.

Reaaliaikainen Clarken muunnos

Työssä suunniteltiin ja rakennettiin laite, joka suorittaa reaaliaikaisen Clarken muunnoksen kolmivaiheiselle mittaussignaalille. Kolmivaiheisella mittaussignaalilla tarkoitetaan tässä kolmivaiheisesta järjestelmästä mitattuja vaihevirtoja tai -jännitteitä. Lähtö tuottaa kaksivaiheisen mittaussignaalin, jota voidaan tutkia oskilloskooppia. Käyttämällä oskilloskooppia xy-moodissa näytölle piirtyy virta- tai jänniteympyrä. Laitetta voidaan käyttää esimerkiksi taajuusmuuttajien testauksen apuvälineenä, jolloin parametrien muuttamisen vaikutus laitteen tuottaman sähkön laatuun nähdään välittömästi.

Junan audiovahvistimen laitesuunnittelu

Joukkoliikenteen merkitys suurten ihmismäärien liikuttamisessa on kasvanut. Kaupunkikeskustat ovat monin paikoin ruuhkautuneet ja joukkoliikenteestä pyritään tekemään mahdollisimman houkuttelevaa ruuhkien helpottamiseksi. Yksi keino houkutella ihmisiä joukkoliikennevälineiden käyttäjiksi on parantaa matkustajille tarjottavan informaation määrää ja laatua. Matkustajainformaatiojärjestelmä on monipuolinen kokonaisuus, jolla joukkoliikenteen käyttäjälle tarjotaan muun muassa opastusta, aikataulutietoa ja häiriötietoa. Informaatio voi olla staattista kuten painetut aikataulut ja kiinteät opasteet tai dynaamista kuten reaaliaikaiset näytöt ja kuulutukset. Informaatiota voidaan tarjota matkustajan käyttöön niin kotona ja liikenneasemilla kuin liikkuvassa kalustossakin. Matkustajainformaatiojärjestelmiä on käytössä erilaisissa joukkoliikennevälineissä, joista tässä diplomityössä syvennytään raideliikenteeseen. Työssä suunnitellaan ja toteutetaan raideliikenteen vaatimukset täyttävä IP-pohjainen audiovahvistin. Valmis vahvistin liittyy Ethernet-verkon välityksellä raideliikenteen matkustajainformaatio-järjestelmään. Laite toimii kuulutus- ja puhelinjärjestelmän keskusyksikkönä. Työn tuloksena saatiin toimiva ja sarjatuotantokelpoinen audiovahvistin. Laitteen tyyppitestit ovat tätä työtä palautettaessa vielä kesken, mutta tähän mennessä testit ovat menneet hyvin ja laite on toiminut hyvin myös osana järjestelmää.