Performance assessment of XACML authorizations for supply chain traceability web services

Service-Oriented Architecture (SOA) and Web Services (WS) offer advanced flexibility and interoperability capabilities. However they imply significant performance overheads that need to be carefully considered. Supply Chain Management (SCM) and Traceability systems are an interesting domain for the use of WS technologies that are usually deemed to be too complex and unnecessary in practical applications, especially regarding security. This paper presents an externalized security architecture that uses the eXtensible Access Control Markup Language (XACML) authorization standard to enforce visibility restrictions on trace-ability data in a supply chain where multiple companies collaborate; the performance overheads are assessed by comparing 'raw' authorization implementations - Access Control Lists, Tokens, and RDF Assertions - with their XACML-equivalents. © 2012 IEEE.

基于分布式适配的服务协作关键技术研究

面向服务的计算（Service Oriented Computing，SOC）与面向服务的体系结构（Service Oriented Architecture，SOA）是分布式系统和软件集成技术领域中的一种新型的计算范型和体系结构。Web服务作为一种自治、开放以及平台无关的网络化构件，可使分布式应用具有更好的可重用性、灵活性和可扩展性，为Internet开放网络环境下的资源共享与业务集成提供了新的解决方案。然而由于Web服务的分布性以及异构、动态和不断演化的特点，使得服务之间的协作变得非常复杂，如何保证服务之间协作的正确性和可靠性便成为应用SOA架构的关键问题。适配技术为解决这一问题提供了可行的解决方案，服务适配使得原本无法正确交互的服务在服务适配器的介入下正确地完成协同工作，从而提高了服务组件的可重用性，实现了复杂系统的高效开发，保证了协作系统的可扩展性和健壮性。因此，服务适配机制的研究对面向服务计算技术的发展以及面向服务架构的成功应用与实施有着重要的意义。 本文在分析服务适配相关工作的基础之上，重点围绕服务协作中的分布式适配结构、适配器流程的自动生成方法，以及适配器的动态演化机制等几个方面的理论基础和关键技术展开研究工作，并建立了支持分布式适配的服务协作支撑框架和原型系统，对上述方法进行验证。本文主要的研究内容和贡献如下： 首先，本文提出了一种自顶向下地实现服务协作中分布式适配的方法。以全局服务协作流程为出发点，基于角色进行投影得到各个参与者对应的抽象服务接口，并以此为依据，为服务组件生成独立的适配器，实现分布式的服务适配结构，从而更加满足开放网络环境对于高效、灵活的服务协作机制的需求。本文深入探究了分布式适配模型的构造方法，定义了模型中各个层次的组成元素，重点给出了失败等价（Failure Equivalent）行为语义保持的投影规则，以保证全局协作流程与生成的抽象服务接口的等价性。 其次，围绕适配器流程的自动生成方法展开研究，现有方法对适配器流程的正确性进行分析时，只能给出确定的“是”或者“否”的结果，而并没有更深入地分析服务行为中无法适配的程度，从而无法对服务交互中的内在关系进行更深入的揭示。本文引入了可适配度的概念，以此来分析服务组件与协作需求的差异性，并给出了基于交互路径的方法来计算无法适配的节点及对应的模式。这样一方面可以依据可适配度来选择合适的服务进行协作，从而降低服务协作应用的开发成本，另一方面，开发人员还可以利用无法适配的相关信息，对服务实现进行有效地修改，这对于服务流程的管理和改进等方面都有着重要的作用。此外，与现有适配器自动生成方法相比，本文所给出的整体构造，一次性检查的方法，有效地降低了自动构造算法的复杂度。 再次，在面向服务的计算与面向服务的软件架构中，服务组件具有动态和不断演化的特性，现有的适配机制只是静态地分析了适配器的结构和相关属性，但是缺乏对适配器响应动态变化的可适应能力的研究。本文研究了适配器流程定义的自动更新以及适配器实例的动态调整方法，从而使适配器具有可重配置以及动态调整的能力，保证了基于适配的服务协作系统的灵活性和动态可适应性。 最后，在上述研究的基础之上，设计与实现了一个原型系统，包含了流程建模，协作管理以及协作运行三大模块，用于实现服务协作中的分布式适配方法。同时，针对每个核心组件，介绍了其功能模块的设计与实现，并基于实例说明了适配器的应用开发过程。

关于网格计算授权机制的研究

分析了目前网格计算中最流行的安全机制GSI(Grid Security Infrastructure,网格安全基础设施)和基于GSI的CAS(Community Authorization Service,组织授权服务),提出了一种基于本地角色授权的、能够解决大规模VO(Virtual Organization,虚拟组织)的授权问题的方案.同GSI和CAS不同的是,本方案中的用户只需要进行本地认证就能够根据其在本地组织的角色来访问VO.

语义Web服务匹配与发现技术研究

在开放的互联网环境中，面向服务的计算（Service-Oriented Computing, SOC）和面向服务的体系架构（Service-Oriented Architecture, SOA）使得信息资源和软件系统的主要形态发生了巨大变化，并引领着互联网计算技术和软件系统新的发展方向。服务是SOC和SOA的核心思想，服务的平台独立、高可重用和松散耦合等特性使之成为复杂分布式应用可行的解决方案。Web服务的出现和发展为实施与部署SOC和SOA提供了最佳支撑技术。目前web服务发现机制在服务描述的全面性和服务匹配方法的有效性方面存在不足之处，难以保证服务发现的性能。特别是在服务数量剧增的情况下，用户亟需一种自动快速而准确的服务发现机制。语义web技术不仅为web的表示内容提供了一种语义标识方法，推动了web内容的自动化和智能化搜索，也为web服务的描述提供了增加语义层次内容的有效方法，两者的结合形成了一个新的研究领域——语义web服务。该领域通过借鉴语义web的相关技术来增加web服务的语义描述，进而为web服务的发现、组合、调用和监控等环节提供语义层次的支持，增强web服务的自动化和智能化水平。 本文的研究目的就是利用语义web的思想，基于SOC和SOA的理念以及现有的web服务发现机制对web服务信息进行语义描述、组织，探索语义web服务匹配与发现的关键问题，提出有效的解决方案。本文的研究工作和贡献主要在以下四个方面： 1. 针对语义近似度的度量和计算问题基于OWL（Web Ontology Language）提出了一个语义近似度计算SSM模型，该模型中所有概念及概念之间的关系、所有的概念属性及属性之间的关系都被抽象定义并建模，根据概念、属性及其语义关系模型，构建了基于概念关系的拓扑近似度计算函数和属性近似度计算函数，从而进一步构建语义近似度计算函数。该语义近似度计算函数以代表OWL本体概念上下级关系和等价关系的树状结构为基础，利用概念间的拓扑关系和属性关系进行语义近似度的度量和计算。语义近似度函数的返回值为一个介于0与1之间的数值，代表函数的两个输入概念之间的语义近似度值。 2. 提出了一个基于概念语义近似度的以OWL-S为顶层本体的web服务语义匹配PSM模型。该模型将服务的匹配项分为服务能力、服务质量、服务名称和服务参数四个部分。基于该模型，提出了相应的PSM服务匹配算法。PSM算法能够对服务内部的服务流程及流程的组合进行与服务请求的语义匹配，并且避免了服务流程中互斥接口参数参与匹配。而且PSM匹配算法实现了服务接口的单射匹配，进一步提高服务发现的性能。在服务质量匹配计算上，提出了服务质量匹配模型PSM-QoS，为服务的QoS匹配建立了计算基础。PSM算法使用语义近似度计算函数度量和计算服务属性概念的语义近似度值，从而能够返回细粒度的服务匹配度值。 3. 在语义服务匹配PSM模型的基础上提出一种语义web服务发现架构系统PSM-SD模型。该模型将OWL-S语义元素引入UDDI服务描述，从而在UDDI中保存语义信息。通过PSM算法提高web服务匹配性能，并通过数据映射机制保证模型对于当前的服务发现标准UDDI基础架构的兼容以及UDDI标准操作接口的透明性。模型使用本体概念的索引机制提高服务发现的效率。在建立和维护索引的过程或服务的匹配过程中，模型使用近似概念搜寻算法进一步提高本体概念搜寻和服务匹配的效率。 4. 设计并开发了基于语义web服务发现架构模型的原型系统。该系统将语义近似度计算模型、语义web服务匹配模型和语义web服务发现架构模型进行软件实现。本文在该原型系统平台上对语义web服务发现的方法进行了实验，验证了方法的有效性。

普适计算环境下服务组合及部署的研究

普适计算（Pervasive Computing）的出现改变了传统的以计算机为中心的资源和信息获取模式，提出一种以人为本的计算方式，为人们提供随时随地、适应环境变化的资源和信息的获取方法，成为下一代网络的主流发展方向之一。普适计算具有环境异构并且动态变化的特点，在这种网络环境中信息的开发和集成打破了传统的模式，软件变服务的观点被普遍接受，并且得到了广泛的应用。因此，面向服务的计算（Service-oriented Computing）和普适计算的结合，是未来信息技术的下一阶段，也成为目前研究的热点问题。 一方面针对普适计算的特点，研究其动态变化、移动性和用户相关性等；一方面针对面向服务的计算，研究其体系结构、服务的描述、查询、组合、部署等问题。普适计算的特点决定了在该环境下的服务组合需要适应环境的动态变化；服务部署需要满足资源约束条件，提高网络资源利用率。基于研究背景以及对目前存在问题的分析，本文进行普适计算环境下服务组合及部署的研究，主要工作包括以下四个方面： （1）提出了一种规则驱动上下文相关的服务组合方法 服务组合是面向服务的计算中经典问题，研究成果包括组合模型、语言、方法和系统等，根据需求提出基于工作流、基于形式化方法、基于语义以及基于服务非功能属性等多种服务组合方法，但这些方法难以解决普适计算中的服务组合问题。因为在普适计算环境下，服务组合不仅需要满足功能性要求，而且要适应环境的异构和动态变化，能够根据环境变化自动的构建组合路径并动态的绑定服务。本文使用上下文刻画普适计算的动态变化性，提出一种基于本体的上下文模型和描述语言，并扩展服务描述，将上下文引入服务组合，提出服务组合算法，实现了规则驱动上下文相关的服务组合路径的建立。 （2）提出一种基于上下文协商的动态服务选取方法 服务组合路径建立了服务执行的先后顺序，在服务的执行期间需要动态的绑定实例，绑定服务实例过程称为动态的服务选取。考虑到普适计算中设备资源有限性以及提高网络资源利用率，本文提出一种基于上下文协商的服务选取方法。首先从已有的上下文本体中获取与动态服务选取相关的上下文，并根据其内容的不同分为用户上下文、设备上下文和服务上下文；然后给出上下文协商的约束条件，基于约束条件提出了上下文的协商算法，进行服务的选取绑定，实现动态服务组合。最后通过实验验证了算法的效率和有效性，分析了上下文数目和服务数目的变化，对服务组合成功率、资源利用率、服务选择冲突率等的影响。 （3）提出普适计算环境下的服务动态部署问题及算法 某些特定的应用（如数字家庭等）需要将服务部署在一个普适计算环境中，部署时需要考虑网络中负载均衡，提高资源利用率。本文针对普适计算中设备异构、资源有限的特点，给出组合服务动态部署问题的描述，并说明该问题是一个NP问题，提出一个启发式算法，能够在多项式时间内找到近似最优解，最后通过算法模拟和实验验证了算法的有效性以及时间性能，说明该方法适用于设备或者原子服务数目较多的普适计算环境。 （4）实现了一个服务组合原型系统 本文在国家八六三项目和国家科技攻关项目研究的基础上，实现了一个服务组合原型系统，该系统是“Web服务计算平台”的一部分，并以分布式文档管理系统为例，给出了服务组合的实现效果。

基于OSGi的Web容器重构

The OSGi component architecture for software development can better meet the requirements of current Internet environment in scalability, readability and reusability. This paper presents an approach to refactor legacy softwares towards service-oriented systems using the OSGi as the foundation framework. A case study on reconstructing our Web container system is also involved to validate the approach.

Activity Zones for Context-Aware Computing

Location is a primary cue in many context-aware computing systems, and is often represented as a global coordinate, room number, or Euclidean distance various landmarks. A user?s concept of location, however, is often defined in terms of regions in which common activities occur. We show how to partition a space into such regions based on patterns of observed user location and motion. These regions, which we call activity zones, represent regions of similar user activity, and can be used to trigger application actions, retrieve information based on previous context, and present information to users. We suggest that context-aware applications can benefit from a location representation learned from observing users. We describe an implementation of our system and present two example applications whose behavior is controlled by users? entry, exit, and presence in the zones.

Design and Implementation of Statistical Rate Monotonic Scheduling in KURT Linux

Statistical Rate Monotonic Scheduling (SRMS) is a generalization of the classical RMS results of Liu and Layland [LL73] for periodic tasks with highly variable execution times and statistical QoS requirements. The main tenet of SRMS is that the variability in task resource requirements could be smoothed through aggregation to yield guaranteed QoS. This aggregation is done over time for a given task and across multiple tasks for a given period of time. Similar to RMS, SRMS has two components: a feasibility test and a scheduling algorithm. SRMS feasibility test ensures that it is possible for a given periodic task set to share a given resource without violating any of the statistical QoS constraints imposed on each task in the set. The SRMS scheduling algorithm consists of two parts: a job admission controller and a scheduler. The SRMS scheduler is a simple, preemptive, fixed-priority scheduler. The SRMS job admission controller manages the QoS delivered to the various tasks through admit/reject and priority assignment decisions. In particular, it ensures the important property of task isolation, whereby tasks do not infringe on each other. In this paper we present the design and implementation of SRMS within the KURT Linux Operating System [HSPN98, SPH 98, Sri98]. KURT Linux supports conventional tasks as well as real-time tasks. It provides a mechanism for transitioning from normal Linux scheduling to a mixed scheduling of conventional and real-time tasks, and to a focused mode where only real-time tasks are scheduled. We overview the technical issues that we had to overcome in order to integrate SRMS into KURT Linux and present the API we have developed for scheduling periodic real-time tasks using SRMS.

A scalable strategy for the parallelization of multiphysics unstructured mesh-iterative codes on distributed-memory systems

Realizing scalable performance on high performance computing systems is not straightforward for single-phenomenon codes (such as computational fluid dynamics [CFD]). This task is magnified considerably when the target software involves the interactions of a range of phenomena that have distinctive solution procedures involving different discretization methods. The problems of addressing the key issues of retaining data integrity and the ordering of the calculation procedures are significant. A strategy for parallelizing this multiphysics family of codes is described for software exploiting finite-volume discretization methods on unstructured meshes using iterative solution procedures. A mesh partitioning-based SPMD approach is used. However, since different variables use distinct discretization schemes, this means that distinct partitions are required; techniques for addressing this issue are described using the mesh-partitioning tool, JOSTLE. In this contribution, the strategy is tested for a variety of test cases under a wide range of conditions (e.g., problem size, number of processors, asynchronous / synchronous communications, etc.) using a variety of strategies for mapping the mesh partition onto the processor topology.

A policy-definition language and prototype implementation library for policy-based autonomic systems

This paper presents work towards generic policy toolkit support for autonomic computing systems in which the policies themselves can be adapted dynamically and automatically. The work is motivated by three needs: the need for longer-term policy-based adaptation where the policy itself is dynamically adapted to continually maintain or improve its effectiveness despite changing environmental conditions; the need to enable non autonomics-expert practitioners to embed self-managing behaviours with low cost and risk; and the need for adaptive policy mechanisms that are easy to deploy into legacy code. A policy definition language is presented; designed to permit powerful expression of self-managing behaviours. The language is very flexible through the use of simple yet expressive syntax and semantics, and facilitates a very diverse policy behaviour space through both hierarchical and recursive uses of language elements. A prototype library implementation of the policy support mechanisms is described. The library reads and writes policies in well-formed XML script. The implementation extends the state of the art in policy-based autonomics through innovations which include support for multiple policy versions of a given policy type, multiple configuration templates, and meta-policies to dynamically select between policy instances and templates. Most significantly, the scheme supports hot-swapping between policy instances. To illustrate the feasibility and generalised applicability of these tools, two dissimilar example deployment scenarios are examined. The first is taken from an exploratory implementation of self-managing parallel processing, and is used to demonstrate the simple and efficient use of the tools. The second example demonstrates more-advanced functionality, in the context of an envisioned multi-policy stock trading scheme which is sensitive to environmental volatility

Generic support for policy-based self-adaptive systems

This paper presents a policy definition language which forms part of a generic policy toolkit for autonomic computing systems in which the policies themselves can be modified dynamically and automatically. Targeted enhancements to the current state of practice include: policy self-adaptation where the policy itself is dynamically modified to match environmental conditions; improved support for non autonomics-expert developers; and facilitating easy deployment of adaptive policies into legacy code. The policy definition language permits powerful expression of self-managing behaviours and facilitates a diverse policy behaviour space. Features include support for multiple versions of a given policy type, multiple configuration templates, and meta policies to dynamically select between policy instances. An example deployment scenario illustrates advanced functionality in the context of a multi policy stock trading system which is sensitive to environmental volatility.

Analysing orchestrations with risk profiles and angel-daemon games

In this paper game theory is used to analyse the effect of a number of service failures during the execution of a grid orchestration. A service failure may be catastrophic in that it causes an entire orchestration to fail. Alternatively, a grid manager may utilise alternative services in the case of failure, allowing an orchestration to recover, A risk profile provides a means of modelling situations in a way that is neither overly optimistic nor overly pessimistic. Risk profiles are analysed using angel and daemon games. A risk profile can be assigned a valuation through an analysis of the structure of its associated Nash equilibria. Some structural properties of valuation functions, that show their validity as a measure for risk, are given. Two main cases are considered, the assessment of Orc expressions and the arrangement of a meeting using reputations.

A Web-Service Based Approach for Software Sharing

A Web-service based approach is presented which enables geographically dispersed users to share software resources over the Internet. A service-oriented software sharing system has been developed, which consists of shared applications, client applications and three types of services: application proxy service, proxy implementation service and application manager service. With the aids of the services, the client applications interact with the shared applications to implement a software sharing task. The approach satisfies the requirements of copyright protection and reuse of legacy codes. In this paper, the role of Web-services and the architecture of the system are presented first, followed by a case study to illustrate the approach developed.

Wrapping Legacy Applications into Grid Services: A Case Study of a Three Services Approach

In this paper, the support for legacy application, which is one of the important advantages of Grid computing, is presented. The ability to reuse existing codes/applications in combination with other Web/Internet technologies, such as Java, makes Grid computing a good choice for developers to wrap existing applications behind Intranet or the Internet. The approach developed can be used for migrating legacy applications into Grid Services, which speeds up the popularization of Grid technology. The approach is illustrated using a case study with detailed description of its implementation step by step. Globus Toolkit is utilized to develop the system.