WP2: ASSERT aware Service Based Systems Design and Deployment

WP Leader: City University of London


Current techniques for the design and deployment of service based systems do not incorporate adequate mechanisms for the consideration of security and dependability properties and cannot take advantage of services with certificates for such properties. This shortcoming relates not only to the initial design and identification of the required service orchestrations for a service based system but also to design for adaptation of such systems at runtime when changes in the deployed services make this adaptation necessary. The main objective of this workpackage is to address these shortcomings by developing mechanisms supporting the utilisation of ASSERT certificates and their associated reasoning mechanisms within key phases in the life cycle of service based systems, notably service based system design, service discovery and dynamic adaptation during system deployment. The workpackage will also focus on securing the relevant discovery, design and adaptation processes.

Task 2.1: ASSERT aware service discovery (Leader: City, M1-M12):
In this task we will develop mechanisms enabling certificate–aware service discovery during SBS design and runtime deployment. These mechanisms will enable: (a) the specification of service discovery conditions about certificates, including the properties they refer to, the evidence underpinning them and their current validity, and (b) the assessment of such conditions as part of a discovery process that incorporates additional criteria (e.g. criteria about service interface and behaviour). This will be achieved by selecting and extending an existing query language for service discovery to support the specification of the required certificate conditions. The
selection will be based on reviewing existing query languages for design and runtime service discovery queries with the view to select a language that supports both types of discovery (i.e., design and runtime) as well as the expression of a comprehensive set of discovery criteria (interface, behavioural and quality of service criteria) and requirements identified in WP7. Examples of candidate service query languages include SerDiQuel[ZSD08], USQL [PTA06] and the description logic (DL) based language in [HPH03]. In ASSERT4SOA, we will extend the selected language to enable the expression of conditions about certificates and develop mechanisms to support the exact and/or inexact matching of certificates related service discovery criteria. Inexact matching will be based
on partial certificate orderings that will be developed in ASSERT4SOA (where available), and the specification of allowances for condition relaxation during the query evaluation process.

Task 2.2: ASSERT aware service based system design (Leader: City, M7-M20):
This task will focus on developing mechanisms supporting the use of certificates during the initial design of service orchestrations. These mechanisms will identify whether properties required of system will be preserved by a particular design of a service orchestration if particular services with certified properties become part of it. Reasoning at this layer will assume that the properties stated in the certificates of the individual services hold without attempting to re–construct their proofs (such proofs have already been generated when creating the certificates based on mechanisms developed in WP3–WP6). Instead the focus of this task will be the development of lightweight mechanisms for assessing whether the properties required from a service orchestration are satisfied given the certified properties of the individual services and what can be the evidence underpinning the relevant conjectures given the proof methods that have been used in the service certificates (that is the question of what is the evidence for an orchestration property P1 that follows from the certified properties P2 and P3 if the evidence underpinning the certification of P2 is a test and the evidence underpinning the certification of E3 is a formal proof). This task will also develop mechanisms supporting developers to specifycertificates–aware runtime system adaptability policies. Such policies will determine conditions determining when and how system services can be replaced at runtime and whether single service discovery and/or adaptations of the existing service orchestration within a system should be attempted. Such policies will incorporate conditions related to the presence or absence of certificates in cases where the adaptation of a service based systems becomes necessary at runtime.

Task 2.3: ASSERT aware adaptation of service orchestrations (Leader: City, M13-M30):
When services become unavailable at runtime and/or fail to provide required properties, the discovery of single services to replace them in an SBS is the first measure that can be taken to rectify the problem. This measure, however, might not be effective as it might not be possible to find single services to replace those that have created the problem. When this happens, more complex forms of system adaptation that alter the orchestration of an SBS (as opposed to replacing single services within it) may be required to address the problem. Taking into account certificates in this process is necessary and this task will develop mechanisms to address this
requirement. In particular, in this task we will identify and specify patterns for adaptation of service orchestrations that are known to preserve certain properties to varying degrees depending on the certificates that are available for these properties in the constituent services of the orchestration. ASSERT4SOA will utilise these patterns for identifying bundles (as opposed to single) of services with known properties at runtime efficiently. The application of certificates aware adaptation patterns will be determined by policies developed as part of Task 2.1.

Task 2.4: Baseline for managing ASSERTs in service based systems lifecycle (Leader: City, M13-M36):
This task will focus on the identification and development of basic mechanisms for utilising ASSERT certificates in the different stages of the service based systems life cycle, including mechanisms for storing, revoking, distributing and validating service certificates. The development of these mechanisms will be based on reviewing state of the art techniques for the certificate management operations identified above and requirements for securing the SBS design, discovery and adaptation processes.

template joomla