A middleware for reflective web service choreographies on the cloud

Furtado, Thiago; Francesquini, Emílio; Lago, Nelson; Kon, Fábio

doi:10.1145/2677017.2677026

Cited by 9 publications

(5 citation statements)

References 20 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Unlike the orchestration, there is no privileged entities in the choreography. Furtado et al [45] argued that web services composition, in particular choreography, is a suitable solution used to build application and systems in the cloud. They built a middleware solution that is capable of automatically deploying and executing web services in the cloud.…”

Section: Modeling Of Cloud Applicationsmentioning

confidence: 99%

A Framework for the Attack Tolerance of Cloud Applications Based on Web Services

Ouffoué¹,

Zaïdi

Cavalli

et al. 2020

Electronics

View full text Add to dashboard Cite

Information systems of companies and organizations are increasingly designed using web services that allow different applications written in different programming languages to communicate. These systems or some parts of them are often outsourced on the cloud, first to leverage the benefits of cloud platforms (e.g., scalability) and also to reduce operational costs of companies as well. However, web services as well as cloud platforms may be the target of attacks that alter their security, and the security of web services is not completely addressed. The solutions proposed in the literature are sometimes specific to certain types of attacks and they cannot ensure the attack tolerance of web services. Attack tolerance can be defined as the capability of a system to function properly with minimal degradation of performance, even if the presence of an attack is detected. As such, we claim that, to achieve attack tolerance, one should detect attacks by a continuous monitoring and mitigate the effects of these attacks by reliable reaction mechanisms. For this aim, an attack tolerance framework is proposed in this paper. This framework includes the risks analysis of attacks and is based on diversification and software reflection techniques. We applied this framework to cloud applications that are based on web services. After describing the core foundation of this approach, we express such cloud applications as choreographies of web services according to their distributed nature. The framework has been validated through an electronic voting system. The results of these experiments show the capability of the framework to ensure the required attack tolerance of cloud applications.

show abstract

Section: Modeling Of Cloud Applicationsmentioning

confidence: 99%

A Framework for the Attack Tolerance of Cloud Applications Based on Web Services

Ouffoué¹,

Zaïdi

Cavalli

et al. 2020

Electronics

View full text Add to dashboard Cite

show abstract

“…The MMT-Security properties are intended for formally specifying the occurrence of events that denotes a security rule to be respected or an attack or vulnerability to be avoided. They rely on LTL (Linear Temporal Logic) [Gabbay et al, 1994] and are written in XML format. This has the advantage of being a simple and straight forward structure for the verification and processing performed by the tool.…”

Section: Formalism Descriptionmentioning

confidence: 99%

“…Moreover the interconnection of services is facilitated by the use of distributed cloud platforms. [Furtado et al, 2014] argued that Web services composition, in particular choreography is a suitable solution used to build application and systems on the cloud. They built a middleware solution that is capable of automatically deploying and executing Web services on the cloud.…”

Section: Web Services and Cloud Applicationsmentioning

confidence: 99%

Attack Tolerance for Services-Based Applications in the Cloud

Ouffoué

Zaïdi

Cavalli

2019

Testing Software and Systems

View full text Add to dashboard Cite

Web services allow the communication of heterogeneous systems on the Web. These facilities make them particularly suitable for deploying in the cloud. Although research on formalization and verification has improved trust in Web services, issues such as high availability and security are not fully addressed since the solutions proposed are sometimes attack-specific. In addition, Web services deployed in cloud infrastructures inherit their vulnerabilities. For example when different tenants in a cloud platform consume the same instance of the service, attacks such as side-channel can be performed by malicious tenants. Because of this limitation, they may be unable to perform their tasks perfectly. In this thesis, we claim that a good tolerance requires attack detection and continuous monitoring on the one hand; and reliable reaction mechanisms on the other hand. We therefore proposed a new formal monitoring methodology that takes into account the risks that our services may face. To implement this methodology, we first developed an approach of attack tolerance that leverages model-level diversity. We define a model of the system and derive more robust functionally equivalent variants that can replace the first one in case of attack. To avoid manually deriving the variants and to increase the level of diversity, we proposed a second complementary approach. The latter still consists in having different variants of our services; but unlike the first, we have a single model and the implementations differ at the language, source code and binaries levels. Moreover, to ensure detection of insider attacks, we investigated a new detection and reaction mechanism based on software reflection. While the program is running, we analyze the methods to detect malicious executions. When these malicious activities are detected, using reflection again, new efficient implementations are generated as a countermeasure. Finally, we leveraged a formal Web service testing framework by incorporating these complementary mechanisms in order to take advantage of the benefits of each of them. iii Résumé Les services Web permettent la communication de systèmes hétérogènes sur le Web. Ces facilités font que ces services sont particulièrement adaptés au déploiement dans le cloud. Les efforts de formalisation et de vérification permettent d'améliorer la confiance dans les services Web, néanmoins des problèmes tels que la haute disponibilité et la sécurité ne sont pas entièrement pris en compte. Par ailleurs, les services Web déployés dans une infrastructure cloud héritent des vulnérabilités de cette dernière. En raison de cette limitation, ils peuvent être incapables d'exécuter parfaitement leurs tâches. Dans cette thèse, nous pensons qu'une bonne tolérance nécessite un monitoring constant et des mécanismes de réaction fiables. Nous avons donc proposé une nouvelle méthodologie de monitoring tenant compte des risques auxquels peuvent être confrontés nos services. Pour mettre en oeuvre cette méthodologie, nous avons d'abord développé une méthode de ...

show abstract

“…Weyns et al [26] present a comprehensive reference model for distributed self-adaptive systems with a special attention to the reflection perspective. As applications of the reflection concepts in web services, [27,28] present adaptive and reflective middleware systems which are able to expose their functionalities to application developers. Our metamodels are inspired by these studies.…”

Section: Reflective Middlewarementioning

confidence: 99%

Infracomposer: Policy-driven adaptive and reflective middleware for the cloudification of simulation & optimization workflows

Beni

Lagaisse

Joosen

2019

Journal of Systems Architecture

View full text Add to dashboard Cite

The simulation and optimization of complex engineering designs in automotive or aerospace involves multiple mathematical tools, long-running workflows and resource-intensive computations on distributed infrastructures. Finding the optimal deployment in terms of task distribution, parallelization, collocation and resource assignment for each execution is a step-wise process involving both human input with domain-specific knowledge about the tools as well as the acquisition of new knowledge based on the actual execution history. In this paper, we present a policy-driven adaptive and reflective middleware that supports smart cloud-based deployment and execution of engineering workflows. This middleware supports deep inspection of the workflow task structure and execution, as well as of the very specific mathematical tools, their executions and used parameters. The reflective capabilities are based on multiple meta-models to reflect workflow structure, deployment, execution and resources. Adaptive deployment is driven by both human input as meta-data annotations as well as adaptation policies that reason over the actual execution history of the workflows. We validate and evaluate this middleware in real-life application cases and scenarios in the domain of aeronautics.

show abstract

A middleware for reflective web service choreographies on the cloud

Cited by 9 publications

References 20 publications

A Framework for the Attack Tolerance of Cloud Applications Based on Web Services

A Framework for the Attack Tolerance of Cloud Applications Based on Web Services

Attack Tolerance for Services-Based Applications in the Cloud

Infracomposer: Policy-driven adaptive and reflective middleware for the cloudification of simulation & optimization workflows

Contact Info

Product

Resources

About