Search

This chapter steps back from specific self-organisational architectural solutions to consider what self-organisation means in the context of complex systems. Drawing on insights in complexity and self-organisation, the chapter explores how the natural propensity of complex systems (such as the mammalian immune system) to self-organise could be exploited as a mechanism for adaptation in complex computer architectures. Drawing on experience of immune-inspired fault-tolerant swarm robotics, the chapter speculates on how complex systems such as global information systems could adopt self-organised survivability. [ABSTRACT FROM AUTHOR]

The development of Enterprise Information Systems (EIS) raises specific challenges related to the scale and complexity of the business processes that must be supported. Techniques for managing the challenges of scale and complexity are often based on modelling, and are targeted at different parts of the EIS development process. This paper presents the results of an evaluation of a number of goal-oriented analysis approaches in the domain of EIS, based on an example EIS for health care. The paper concludes that existing approaches lack process guidance and, in particular, guidance on the evaluation of the results of goal analysis. We present an analysis of the problem of evaluation, and propose a scenario-based approach to evaluate the results of goal analysis. [ABSTRACT FROM AUTHOR]

Model-Driven Engineering tasks, such as simulation or transformation, often cannot be carried out directly on the models at hand; models often need to be decorated with additional information, and this information is in some cases not accounted for by existing metamodels. Moreover, engineers often need to experiment with alternative and complementary types of model decorations, particularly when carrying out more exploratory styles of development. Heavyweight approaches to decoration are not convenient in such situations. In this paper we demonstrate the limitations of existing model decoration mechanisms and tools, and present a novel approach that enables engineers to capture decoration information in the form of separate interchangeable models. The approach allows engineers to transparently and programmatically navigate decorations as if they were embedded in the decorated model. [ABSTRACT FROM AUTHOR]

In their recent book, Mens and Demeyer state that Model-Driven Engineering introduces additional challenges for controlling and managing software evolution. Today, tools exist for generating model editors and for managing models with transformation, validation, merging and weaving. There is limited support, however, for model migration - a development activity in which instance models are updated in response to metamodel evolution. In this paper, we describe Epsilon Flock, a model-to-model transformation language tailored for model migration that contributes a novel algorithm for relating source and target model elements. To demonstrate its conciseness, we compare Flock to other approaches. [ABSTRACT FROM AUTHOR]

Modelling languages and thus their metamodels are subject to change. When a metamodel evolves, existing models may no longer conform to the evolved metamodel. To avoid rebuilding them from scratch, existing models must be migrated to conform to the evolved metamodel. Manually migrating existing models is tedious and error-prone. To alleviate this, several tools have been proposed to build a migration strategy that automates the migration of existing models. Little is known about the advantages and disadvantages of the tools in different situations. In this paper, we thus compare a representative sample of migration tools – AML, COPE, Ecore2Ecore and Epsilon Flock – using common migration examples. The criteria used in the comparison aim to support users in selecting the most appropriate tool for their situation. [ABSTRACT FROM AUTHOR]

EMF and GMF are powerful frameworks for implementing tool support for modelling languages in Eclipse. However, with power comes complexity; implementing a graphical editor for a modelling language using EMF and GMF requires developers to hand craft and maintain several low-level interconnected models through a loosely-guided, labour-intensive and error-prone process. In this paper we demonstrate how the application of model transformation techniques can help with taming the complexity of GMF and EMF and deliver significant productivity, quality, and maintainability benefits. We also present EuGENia, an open-source tool that implements the proposed approach, illustrate its functionality through an example, and report on the community΄s response to the tool. [ABSTRACT FROM AUTHOR]

A change to a software development artefact, such as source code or documentation, can affect the integrity of others. Many contemporary software development environments provide tools that automatically manage (detect, report and reconcile) integrity. For instance, incremental background compilation can reconcile object code with changing source code and report calls to a method that are inconsistent with its definition. Although models are increasingly first-class citizens in software development, contemporary development environments are less able to automatically detect, manage and reconcile the integrity of models than the integrity of other types of artefact. In this paper, we discuss the scalability and efficiency problems faced when managing model integrity for two categories of change that occur in MDE. We present a framework to support the incremental management of model integrity, evaluating the efficiency of the proposed approach atop Eclipse and EMF. [ABSTRACT FROM AUTHOR]

Scalability is particularly important for the adoption of Model Driven Engineering (MDE) in an industrial context. The current focus of research in MDE is on declarative languages for model management, and scalable mechanisms for persisting models (e.g., using databases). In this paper we claim that, instead, modularity and encapsulation in modelling languages should be the main focus. We justify this claim by demonstrating how these two principles apply to a related domain – code development – where the issue of scalability has been addressed to a much greater extent than in MDE. [ABSTRACT FROM AUTHOR]

The Object Constraint Language (OCL) can be used to capture structural constraints in the context of the abstract syntax of modelling languages (metamodels) defined in the MOF metamodelling architecture. While the expression language of OCL has been revised and updated a number of times since its inception, the constructs used for capturing constraints (invariants) have remained unchanged. In this paper we argue that the abstract and concrete syntax of OCL invariants should also be updated to address a number of shortcomings and render OCL more usable in a contemporary modelling environment. To support our arguments we have implemented the proposed extensions in the prototype Epsilon Validation Language (EVL). To demonstrate the benefits delivered, we present and discuss a concrete example. [ABSTRACT FROM AUTHOR]

As part of our work on the formal analysis of object-oriented models, we turn to systems where many autonomous individuals interact to give rise to complex collective behaviour. We adapt our ZOO [1,2] structuring and apply it to a case study based on a published model of part of the immune system [3]. The formalisation calls for a bottom-up solution with no central control over individual units, and includes an approach to represent feedback channels enabling broadcast communication between individuals and across levels. [ABSTRACT FROM AUTHOR]

Support for automated model transformation is essential for realizing a Model Driven Development (MDD) process. However, model transformation is only one of the many tools in a model engineering toolkit. To apply MDD in the large, automated support for a number of additional tasks such as model comparison, merging, validation and model-to-text transformation, is essential. While a number of successful model transformation languages have been currently proposed, the majority of them have been developed in isolation and as a result, they face consistency and integration difficulties with languages that support other model management tasks. We present the Epsilon Transformation Language (ETL), a hybrid model transformation language that has been developed atop the infrastructure provided by the Epsilon model management platform. By building atop Epsilon, ETL is seamlessly integrated with a number of other task-specific languages to help to realize composite model management workflows. [ABSTRACT FROM AUTHOR]

We introduce the concept of neutral emergence (defined by analogy to an information theoretic view of neutral evolution), and discuss how it might be used in the engineering of robust emergent systems. We describe preliminary results from an application to coarse graining of cellular automata. [ABSTRACT FROM AUTHOR]

In the context of Model Engineering, work has focused on operations such as model validation and model transformation. By contrast, other model management operations of significant importance remain underdeveloped. One of the least elaborated operations is model merging. In this paper we discuss the special requirements of model merging and introduce the Epsilon Merging Language (EML), a rule-based language, with tool support, for merging models of diverse metamodels and technologies. Moreover, we identify special cases of model merging that are of particular interest and provide a working example through which we demonstrate the practicality and usefulness of the proposed language. [ABSTRACT FROM AUTHOR]

Rich, context-aware applications are emerging for mobile computing environments that provide new and innovative services to consumers. Security is critical for the successful realization of this vision. We propose a new method for authentication that utilizes contextual information to overcome the limitations inherent in traditional approaches. We have defined a model that uses contextual attributes to achieve an approach to authentication that is better suited for dynamic, mobile computing environments. We examine the use of trusted platforms to provide assurances for these contextual attributes. Our model promotes the adoption of many revolutionary mobile applications by providing a seamless and flexible user experience that can protect privacy and reduce administrative overhead. [ABSTRACT FROM AUTHOR]

We study a protocol, called BIO3G, which provides biometric-based user authentication and key establishment in Third Generation (3G) mobile environments. BIO3G provides end-to-end user authentication to the mobile operator, requiring no storing or transferring of biometric data and, eliminating the need for biometric enrolment and administration, which is time-consuming for the user and expensive for the mobile operator. We model BIO3G using process algebra Communicating Sequential Processes (CSP) and verify it using Schneider's rank functions. [ABSTRACT FROM AUTHOR]

The vision of a landscape of heterogeneous web services deployed as encapsulated business software assets in the Internet is currently becoming a reality as part of the Semantic Web. When pro-active agents handle the context-aware discovery, acquisition, composition, and management of application services and data, ensuring the security of customers' data becomes a principle task. To dynamically compose its offered service, an agent has to process and spread confidential data to other web services demanding the required degree of security. In this paper we propose a methodology based on type-based information flow to control the security of dynamically computed data and their proliferation to other web services. [ABSTRACT FROM AUTHOR]

In pervasive computing environments, information gateways derive specific information, such as a person's location, from raw data provided by a service, such as a videostream offered by a camera. Here, access control to confidential raw data provided by a service becomes difficult when a client does not have access rights to this data. For example, a client might have access to a person's location information, but not to the videostream from which a gateway derives this information. Simply granting access rights to a gateway will allow an intruder into the gateway to access any raw data that the gateway can access. We present the concept of derivation-constrained access control, which requires a gateway to prove to a service that the gateway needs requested raw data to answer a client's authorized request for derived information. Therefore, an intruder into the gateway will be limited in its capabilities. We provide a formal framework for derivation-constrained access control based on Lampson et al.'s "speaks-for" relationship. We demonstrate feasibility of our design with a sample implementation and a performance evaluation. [ABSTRACT FROM AUTHOR]

In a wireless communication network, it is possible to locate a user and track its trajectory based on its transmission, during communication with access points. This type of tracking leads to the breach of a user's location privacy. Prior solutions to this problem enhances user's location privacy at the expense of communication Quality of Service(QoS) degradation. In this paper, we propose silent cascade to enhance a user' location privacy by trading users' delay in silent cascade for anonymity. As a result, it avoids the problem of QoS degradation in prior solutions. Furthermore, we abstract silent cascade as a mix-network based formal model, and use this model to evaluate the performance of silent cascade. Study results prove the effectiveness of silent cascade under different types of QoS requirements. Besides, we also derive the optimal configuration of silent cascade to achieves target anonymity within minimum duration of time. and the theoretical upper bound of a silent cascade's anonymity. [ABSTRACT FROM AUTHOR]

Increasing automation of buildings enables rich information streams about the activities of building users to reach networked computer systems. Privacy concerns typically cause this information to be accessible only by building managers and security personnel. However, if appropriate privacy mechanisms can be implemented, then it is possible to deploy location information systems that can contribute to the convenience and efficiency of users. This paper describes a three step approach to privacy-sensitive release of location information collected by building sensors. These steps entail defining an ownership model, defining environment events to be monitored, and creating a sharing model. These steps are described mathematically and then validated through a case study for a system called Janus's Map which provides a location information system for the card reader, door, and occupancy sensors of a modern smart building. [ABSTRACT FROM AUTHOR]

This paper addresses the need for individualized information anytime and anyplace in contrast to the problem of user's right to privacy. The creation and application of profiles is characterized. A extensible middleware approach is proposed to combine independent databases on localization and personal profiles in order to identify the right layer to protect privacy. This will enable telecommunication providers to offer common basic services for the development of a wide range of mobile 3rd party applications. [ABSTRACT FROM AUTHOR]

The success of Ambient Intelligence (AmI) will depend on how secure it can be made, how privacy and other rights of individuals can be protected and how individuals can come to trust the intelligent world that surrounds them and through which they move. This contribution presents an analysis of ambient intelligence scenarios, particularly in regard to AmI's impacts on and implications for individual privacy. The analysis draws on our review of more than 70 AmI projects, principally in Europe. It notes the visions as well as the specifics of typical AmI scenarios. Several conclusions can be drawn from the analysis, not least of which is that most AmI scenarios depict a rather too sunny view of our technological future. Finally, reference is made to the SWAMI project (Safeguards in a World of Ambient Intelligence) which, inter alia, has constructed "dark" scenarios, as we term them, to show how things can go wrong in AmI and where safeguards are needed. [ABSTRACT FROM AUTHOR]

Most security protocols for wireless sensor networks (WSN) assume that the adversary can gain full control over a sensor node through direct physical access (node capture attack). But so far the amount of effort an attacker has to undertake in a node capture attack is unknown. In our project we evaluate different physical attacks against sensor node hardware. Detailed knowledge about the effort needed for physical attacks allows to fine tune security protocols in WSNs so they provide optimal protection at minimal cost. [ABSTRACT FROM AUTHOR]

In this paper, we are concerned with the detection software faults and tampering of the mobile application as well as the mobile device theft. We want to disable mobile device cryptographically once either of these problems are detected. Basically the device needs to receive a new cryptographic key after each pre-set period of time in order to continue function. The mobile application execution integrity is checked by the authority when deciding whether or not to give out a new key. The detection can be done via a run-time result checking when the device connects to the authority. The authority can also proactively examine whether or not software tampering is happening. This paper will show approaches that each standalone can improve the dependability and security of a mobile application. We will show how these approaches can work together seamlessly to form a stronger scheme. [ABSTRACT FROM AUTHOR]

Multivariate (or ) public-key cryptosystems (PKC) are alternatives to traditional PKCs based on large algebraic structures (e.g., RSA and ECC); they usually execute much faster than traditional PKCs on the same hardware. However, one major challenge in implementing multivariates in embedded systems is that the key size can be prohibitively large for applications with stringent resource constraints such as low-cost smart cards, sensor networks (e.g., Berkeley motes), and radio-frequency identification (RFID). In this paper, we investigate strategies for shortening the key of a multivariate PKC. We apply these strategies to the Tame Transformation Signatures (TTS) as an example and quantify the improvement in key size and running speed, both theoretically and via implementation. We also investigate ways to save die space and energy consumption in hardware, reporting on our ASIC implementation of TTS on a TSMC 0.25μm process. Even without any key shortening, the current consumption of TTS is only 21 μA for computing a signature, using 22,000 gate equivalents and 16,000 100-kHz cycles (160 ms). With circulant-matrix key shortening, the numbers go down to 17,000 gates and 4,400 cycles (44 ms). We therefore conclude: besides representing a future-proofing investment against the emerging quantum computers, multivariates can be immediately useful in niches. Keywords: Multivariate public-key cryptosystem, efficient implementation, digital signature schemes, embedded system, sensor networks, motes. [ABSTRACT FROM AUTHOR]

Logging is a central service in computing systems. It lays the foundation for accountability and audit services in computing systems, as well as for other accessory services. While providing logging services in traditional computing systems is a relatively smooth process, it turns to an intricate task in pervasive computing systems. In this context, we present two contributions addressing this problem. First, we develop an approach to securely log information in marginally trusted collectors. Second, we investigate the question of how to securely delegate our logging protocol to a relay equipped with trusted-computing modules. [ABSTRACT FROM AUTHOR]

In this workThis work has been partially supported by the Spanish Government through MYCT (Project TSI2005-08145-C02-02, FEDER funds 70%)., we present a vulnerability in monoprocess or monothreaded servers that allows the execution of DoS attacks with the peculiarity that they are generated by low rate traffic. This feature makes the attack less vulnerable to detection by current IDS systems, which usually expect high rate traffic. The intruder can take advantage of some knowledge about the inter-output times in the server to build the attack. We have simulated and tested it in a real environment, obtaining worrying conclusions due to the efficiency achieved by the attack, with low effort from the attacker. [ABSTRACT FROM AUTHOR]

We propose a set of security provisions for node to base station communication in wireless sensor networks. It supports standard security requirements, viz. authentication of the origin of data and confidentiality of data. Additionally we use key evolution to achieve forward security which is of particular importance in the face of node capture attacks. As a bonus we obtain implicit weak freshness without message expansion. We take the typical resource constraints of wireless sensor networks into account. The security provisions can be superimposed on several communication models, such as the epidemic communication model. [ABSTRACT FROM AUTHOR]

The pervasive computing paradigm assumes an essentially dynamic model of interaction between devices that also motivates the need to discover the services offered by previously unknown parties at an early phase of these interactions. Whereas this assumption is at the heart of many pervasive computing protocols and systems, the necessity of securing service discovery and the complexity of this task have been largely underestimated, if considered at all. This paper discusses the implications of insecure service discovery in available systems and which security objectives should be pursued. The design space for introducing security features into a specific architecture, namely registry-based discovery systems, is then explored and assessed. [ABSTRACT FROM AUTHOR]

In this paper, we consider a multi-layer mobile ad-hoc network (MANET) composed of several kinds of networking units (such as ground soldiers, tanks, and unmanned aerial vehicles) with heterogeneous resources to communicate and compute. In this multi-layer MANET, we first propose a password-based authenticated group key exchange scheme with members' different passwords. The proposed scheme only requires constant-round to generate a group session key under the dynamic scenario, hence it is scalable, i.e., the overhead of key generation is independent of the size of a total group. We support the proposed scheme with formal security proof. Namely, our proposed scheme is the first constant-round password-based group key exchange with different passwords for the dynamic setting of MANET. Keywords: Password authentication, key agreement, authenticated key exchange, heterogeneous, pervasive computing, multi-layer ad-hoc network. [ABSTRACT FROM AUTHOR]

Model-Driven Development requires model management languages and tools for supporting model operations such as editing, consistency checking, and transformation. At the core of these model management techniques is a set of facilities for model navigation and modification. A subset of the Object Constraint Language can be used for some of these tasks, but it has limitations as a general-purpose language to be used in a variety of model management tasks. We present the metamodel independent Epsilon Object Language (EOL) which builds on OCL. EOL can be used both as a standalone generic model management language or as infrastructure on which task-specific languages can be built. We describe how it has been used to construct a selection of languages, such as model merging, comparison, and text generation languages. [ABSTRACT FROM AUTHOR]

Design patterns are usually described in terms of instances. Templates describe sentences of some language with a particular form, generate sentences upon instantiation, and can be used to describe those commonly occurring structures that make a pattern. This paper presents FTL, a language to express templates, and an approach to proof with templates. This enables reuse at the level of formal modelling and verification: patterns of models are captured once and their structure is explored for proof, so that patterns instances can be generated mechanically and proved results related with the pattern can be reused in any context. The paper uses templates to capture the Z promotion pattern and metaproof to prove properties of Z promotion. The proved properties are applicable directly to Z promotions built by template instantiation. Keywords: patterns, templates, proof, Z, formal development. [ABSTRACT FROM AUTHOR]

We consider models of emergence, adding downward causation to conventional models where causation permeates from low-level elements to high-level behaviour. We describe an architecture and prototype simulation medium for tagging and modelling emergent features in CA-like systems. This is part of ongoing work on engineering emergence. Keyword: Cellular Automata, emergence, , simulation. [ABSTRACT FROM AUTHOR]

There is significant interest in the use of Z in conjunction with object-orientation. Here we present a new approach to structuring Z specifications in an object-oriented (OO) style. Our structuring is based on views, it uses the schema calculus, and it does not extend Z. The resulting OO Z specifications are comprehensible, modular, and conceptually clear. The modularity of the new approach supports a template-instantiation approach to expressing OO models in Z; practical formal verification and validation of the model can be undertaken using meta-proof, meta-lemmas, and formal snapshots. Keywords: Z, object-orientation. [ABSTRACT FROM AUTHOR]

Code generation automatically produces executable code by software. Model-driven code generation is currently the most flexible and scalable generative technique, but there are many complaints about the complexity it introduces into the development process, and the design decisions imposed on the code. Here, an agile code-oriented model-driven generative methodology is outlined that reduces complexity and allows the engineer to define the exact form of the produced code and embrace change in the requirements in an automated manner. A flexible tool, ECGF, supports this methodology, and a case study in rapid generation of large-scale HTML documents is outlined. [ABSTRACT FROM AUTHOR]

This extended abstract describes an alternative to trusting individual nodes in pervasive systems, which is to exploit the diversity of nodes in such systems to build application ensembles that are collectively trustworthy. These configurations are resilient to high levels of attack, and are not dependent on large pre-distribution key-spaces. [ABSTRACT FROM AUTHOR]

Software engineering diagrams are hard to verify and formally analyse, often due to inadequately defined diagram semantics: the semantics often does not enable formal analysis, or may be under specified to a degree that does not allow useful properties to be checked. [ABSTRACT FROM AUTHOR]