Thanks to rapid technological advances in the Internet of Things (IoT), a smart public safety (SPS) system has become feasible by integrating heterogeneous computing devices to collaboratively provide public protection services. While a service oriented architecture (SOA) has been adopted by IoT and cyber-physical systems (CPS), it is difficult for a monolithic architecture to provide scalable and extensible services for a distributed IoT based SPS system. Furthermore, traditional security solutions rely on a centralized authority, which can be a performance bottleneck or single point failure. Inspired by microservices architecture and blockchain technology, this paper proposes a BLockchain-ENabled Decentralized Microservices Architecture for Smart public safety (BlendMAS). Within a permissioned blockchain network, a microservices based security mechanism is introduced to secure data access control in an SPS system. The functionality of security services are decoupled into separate containerized microservices that are built using a smart contract, and deployed on edge and fog computing nodes. An extensive experimental study verified that the proposed BlendMAS is able to offer a decentralized, scalable and secured data sharing and access control to distributed IoT based SPS system.
Roberto Tonelli, Maria Ilaria Lunesu, Andrea Pinna, Davide Taibi · 5 authors
Blockchain technologies and smart contracts are becoming mainstream research fields in computer science and researchers are continuously investigating new frontiers for new applications. Likewise, microservices are getting more and more popular in the latest years thanks to their properties, that allow teams to slice existing information systems into small and independent services that can be developed independently by different teams. A symmetric paradigm applies to smart contracts as well, which represent well defined, usually isolated, executable programs, typically implementing simple and autonomous tasks with a well defined purpose, which can be assumed as services provided by the Contract. In this work we analyze a concrete case study where the microservices architecture environment is replicated and implemented through an equivalent set of smart contracts, showing for the first time the feasibility of implementing a microservices-based system with smart contracts and how the two innovative paradigms match together. Results show that it is possible to implement a simple microservices-based system with smart contracts maintaining the same set of functionalities and results. The result could be highly beneficial in contexts such as smart voting, where not only the data integrity is fundamental but also the source code executed must be trustable.
Davy Preuveneers, Vera Rimmer, Ilias Tsingenopoulos, Jan Spooren · 6 authors
The adoption of machine learning and deep learning is on the rise in the cybersecurity domain where these AI methods help strengthen traditional system monitoring and threat detection solutions. However, adversaries too are becoming more effective in concealing malicious behavior amongst large amounts of benign behavior data. To address the increasing time-to-detection of these stealthy attacks, interconnected and federated learning systems can improve the detection of malicious behavior by joining forces and pooling together monitoring data. The major challenge that we address in this work is that in a federated learning setup, an adversary has many more opportunities to poison one of the local machine learning models with malicious training samples, thereby influencing the outcome of the federated learning and evading detection. We present a solution where contributing parties in federated learning can be held accountable and have their model updates audited. We describe a permissioned blockchain-based federated learning method where incremental updates to an anomaly detection machine learning model are chained together on the distributed ledger. By integrating federated learning with blockchain technology, our solution supports the auditing of machine learning models without the necessity to centralize the training data. Experiments with a realistic intrusion detection use case and an autoencoder for anomaly detection illustrate that the increased complexity caused by blockchain technology has a limited performance impact on the federated learning, varying between 5 and 15%, while providing full transparency over the distributed training process of the neural network. Furthermore, our blockchain-based federated learning solution can be generalized and applied to more sophisticated neural network architectures and other use cases.
Blockchain has emerged as a trusted and secure distributed ledger for transactions while also being decentralised, distributed and its legitimacy not guaranteed by a trusted authority. Since the appearance of Bitcoin, Blockchain has known many implementations based on P2P architectures. This paper presents how the blockchain and smart contracts technologies can be integrated into the SwarmESB ecosystem. SwarmESB is a framework that helps building distributed applications, which benefit from privacy and scalability features. Our proposal will present the flexibility in building not only microservices based applications, but also decen-tralised applications employing blockchain and smart-contracts by modeling a sample Dapp.
Holger Kinkelin, Valentin Hauner, Heiko Niedermayer, Georg Carle
Numerous IoT applications, like building automation or process control of\nindustrial sites, exist today. These applications inherently have a strong\nconnection to the physical world. Hence, IT security threats cannot only cause\nproblems like data leaks but also safety issues which might harm people.\nAttacks on IT systems are not only performed by outside attackers but also\ninsiders like administrators. For this reason, we present ongoing work on a\nconfiguration management system (CMS) that provides control over\nadministrators, restrains their rights, and enforces separation of concerns. We\nreach this goal by conducting a configuration management process that requires\nmulti-party authorization for critical configurations to achieve Byzantine\nfault tolerance against attacks and faults by administrators. Only after a\nconfiguration has been authorized by multiple experts, it is applied to the\ntargeted devices. For the whole configuration management process, our CMS\nguarantees accountability and traceability. Lastly, our system is\ntamper-resistant as we leverage Hyperledger Fabric, which provides a\ndistributed execution environment for our CMS and a blockchain-based\ndistributed ledger that we use to store the configurations. A beneficial side\neffect of this approach is that our CMS is also suitable to manage\nconfigurations for infrastructure shared across different organizations that do\nnot need to trust each other.\n
Holger Kinkelin, Valentin Hauner, Heiko Niedermayer, Georg Carle
Numerous IoT applications, like building automation or process control of industrial sites, exist today. These applications inherently have a strong connection to the physical world. Hence, IT security threats cannot only cause problems like data leaks but also safety issues which might harm people. Attacks on IT systems are not only performed by outside attackers but also insiders like administrators. For this reason, we present ongoing work on a Byzantine fault tolerant configuration management system (CMS) that provides control over administrators, restrains their rights, and enforces separation of concerns. We reach this goal by conducting a configuration management process that requires multi-party authorization for critical configurations to prevent individual malicious administrators from performing undesired actions. Only after a configuration has been authorized by multiple experts, it is applied to the targeted devices. For the whole configuration management process, our CMS guarantees accountability and traceability. Lastly, our system is tamper-resistant as we leverage Hyperledger Fabric, which provides a distributed execution environment for our CMS and a blockchain-based distributed ledger that we use to store the configurations. A beneficial side effect of this approach is that our CMS is also suitable to manage configurations for infrastructure shared across different organizations that do not need to trust each other.
M. Teresa Higuera‐Toledano, Uwe Brinkschulte, Achim Rettberg
The increasing complexity of contemporary embedded computing systems requires the use of self-management in order to handle unforeseen changes in both hardware and application environments (i.e., hardware/software defects, resource changes, and non-continual feature usage). Moreover, often these systems are distributed, running on processor architectures with multiple cores, which may require self-organization to ensure efficiency and reliability. Real-time properties are another key issue in many complex systems. Adaptive and self-organized properties extent the area of operations and improves the efficiency of the system resources at the cost to introduce additional complexity, overhead, and resource requirements. Consequently, real-time adaptive systems must be careful analyzed, designed, and built taken into account the right tradeoffs between flexibility and complexity, while accomplishing time-constrains. The combination of the flexibility and uncertain behavior of self-organizing systems with time-predictability is a grand challenge. Therefore, substantial research has been done in the last years to address the so-called Self-X features (e.g., self-configuration, self-optimization, self-adaptation, self-healing, and self-protection). This fact has as resutl that self-organizing computing systems become an established research nowadays as they promise to handle the increasing complexity resulting from highly distributed systems and ubiquitous applications. In addition, real-time properties are required in many areas (such as cyber physical systems) self-organizing computing systems are dealing with. Combining the flexible and and uncertain behavior of self-organizing systems with time-predictability necessary for real-time systems is a grand challenge. The Workshop on Self-Organizing Real-Time Systems (SORT) is specifically dedicated to research on adaptive real-time systems. SORT started 2014 as a workshop attached at International Symposium on Object/Component/Service-Oriented Real-Time Distributed Computing (ISORC). The purpose of this workshop is to provide an open forum to discuss new and ongoing research that is centered on the idea of adaptability in real-time systems. The target audience includes researchers from academia, tool vendors, system suppliers, and users in industry who are interested in the all aspects of the topics mentioned below. This special issue of Concurrency and Computation: Practice and Experience contains four invited papers from the SORT 2014 workshop that has been expanded and carefully peer reviewed. The first paper, titled An Artificial DNA for Self-Descripting and Self-Building Embedded Real-Time Systems 1, Uwe Brinkschulte proposes an approach to use an artificial DNA-based approach for embedded real-time and distributed systems. This kind of systems is growing more and more complex because of the increasing chip integration density, larger number of chips in distributed applications and demanding application fields (e.g., in cars and in households). Bio-inspired techniques like self-organization are a key feature to handle this complexity. Because many embedded systems can be composed from a limited number of basic elements, the structure and parameters of such systems can be stored in a compact way representing an artificial DNA deposited in each computation node. This leads to a self-describing system. Based on the DNA, the self-organization mechanisms can build the system autonomously providing a selfbuilding system. System repair and optimization at runtime are also possible, leading to higher robustness, dependability, and flexibility. Autonomous adaptation in self-adapting embedded real-time systems introduces novel risks as it may lead to unforeseen system behavior. An anomaly detection framework integrated in a real-time operating system can ease the identification of such suspicious novel behavior and, thereby, offers the potential to enhance the reliability of the considered self-x system. However, anomaly detection is based on knowledge about normal behavior. When dealing with self-reconfiguring applications, normal behavior changes. Hence, knowledge base requires adaptation or even reconstruction at runtime. The stringent restrictions of real-time systems considering runtime and memory consumption make this task to a really challenging problem. In next paper, Two-Level Extensions of an Artifical Hormone System 2, Mathias Pacher describes a decentralized software which is able to allocate tasks in a system of heterogeneous processing elements. Tasks are allocated according to their suitability for the heterogeneous processing elements, the current processing element and task relationships. This software provides properties like self-configuration, self-optimization, and self-healing in the context of task allocation. In addition, it is able to guarantee real-time bounds for such self-X-properties. However, using self-organization principles introduces increased system complexity such as control of system parameters for self-organization and additional communication effort, which have been addressed by using a hierarchic structure. This solution uses a machine learning approach presenting an Observer-/Controller architecture. The user has to provide a simple set of initial rules and the Observer-/Controller is able to generate new rules if needed. This paper also presents a hierarchical structure to save communication bandwidth, which consists of several different clusters of processing elements where each cluster has its own communication infrastructure (e.g., a bus system). In the paper titled Online behavior classification for anomaly detection in self-x real-time systems 3, Katharina Stahl presents an online construction of application behavior knowledge that does not rely on training phase. The applications' behavior is defined by the application's system call invocations. For the knowledge base, they use Suffix Trees to represent application behavior patterns and associated information in a compact manner. The online algorithm provided by Suffix Trees is a basis to construct the knowledge base with low computational effort. Anomaly detection and classification is integrated into the online construction method. New behavioral patterns do not unconditionally update the behavior knowledge base. They are evaluated in a context-related manner inspired by Danger Theory, a special discipline of Artificial Immune Systems. For highly safety-critical applications, rigorous offline verification should be complemented by online verification. One promising technique is Online Model Checking (OMC). As OMC is a run- time-provided service, it seems to be natural providing it by an operating system service like any other service offered by the OS. In the paper titled Efficient Integration of Online Model Checking into a Small-Footprint Real-time Operating System 4 the authors study the feasibility of integrating OMC as an RTOS service. In order to ease understanding the approach, the paper discusses various integration methods in which OMC runs concurrently to the application task to be online model checked. The OMC may become: (i) an integral part of the RTOS, (ii) a separate task running on the same host as the RTOS, or (iii) a remote host as a kind of service-oriented architecture.