Submitted by Caroline Periotto (carol@ufscar.br) on 2016-09-26T20:19:11Z No. of bitstreams: 1 DissVNE.pdf: 1613517 bytes, checksum: bd44342cd60c7332f4ed2a360b407235 (MD5) / Approved for entry into archive by Marina Freitas (marinapf@ufscar.br) on 2016-09-27T20:14:41Z (GMT) No. of bitstreams: 1 DissVNE.pdf: 1613517 bytes, checksum: bd44342cd60c7332f4ed2a360b407235 (MD5) / Approved for entry into archive by Marina Freitas (marinapf@ufscar.br) on 2016-09-27T20:14:47Z (GMT) No. of bitstreams: 1 DissVNE.pdf: 1613517 bytes, checksum: bd44342cd60c7332f4ed2a360b407235 (MD5) / Made available in DSpace on 2016-09-27T20:14:53Z (GMT). No. of bitstreams: 1 DissVNE.pdf: 1613517 bytes, checksum: bd44342cd60c7332f4ed2a360b407235 (MD5) Previous issue date: 2016-03-07 / Coordenação de Aperfeiçoamento de Pessoal de Nível Superior (CAPES) / The need to improve software systems to adapt to the new technologies is a constant topic of research. As computing evolves, new challenges emerge and new solutions must be created. The increasing use of various types of devices for access to sites and software and the ease that the Internet provides the information access, force researchers to keep great efforts improving already developed applications, or even thinking of ways to facilitate the development of software to run on multiple devices. The general purpose of this master’s research was focused on this problem, distribute software systems initially designed to run on a single computer in order to eliminate many tasks that the developer thoroughly repeat this process. The approach allows developers to use the source code of any application and distribution models, perform the division of its software quickly in order to test different distributions without time cost. Using concepts of MDD (Model-Driven Development), analyzers and code generators, and concepts of microservices, it developed a partitioner that distributes the source code of an application on multiple servers, creating small services for each, making these services exchange information with each other while maintaining the functionality of the application intact. The partitioner gives flexibility to the programmer to choose the arrangement of classes among the services that will be created. Developers can then easily test different ways to distribute the code of the application without the need of having to develop services and communication between the new services. This approach was called late distribution. Experimental studies were performed to ensure the validity of the project. In total, five different tests were conducted in order to verify the creation of services would be performed as defined by the programmer. In all cases the result was satisfactory, allowing distribution of software code used between the designated servers. / A necessidade de melhoria de sistemas de software para adequarem-se às novas tecnologias é tema constante de pesquisas. Conforme a computação evolui, novos desafios surgem, e novas soluções devem ser criadas. A crescente utilização de diversos tipos de aparelhos para acesso a sites e software, além da facilidade que a Internet proporciona ao acesso de informações, força pesquisadores da área a manterem grandes esforços melhorando aplicações já desenvolvidas, ou mesmo pensando em formas de facilitar o desenvolvimento de software de forma a rodar em vários dispositivos. O intuito geral desta pesquisa de mestrado foi com foco nesse problema, de distribuir sistemas de software inicialmente projetados para rodar em um único computador de maneira a eliminar muitas tarefas que o desenvolvedor repetiria exaustivamente nesse processo. A abordagem permite que programadores possam, a partir do código fonte de alguma aplicação e modelos de distribuição, realizar a divisão do seu software de maneira rápida, a fim de testar diversas distribuições sem custo de tempo. Utilizando conceitos de DSDM (Desenvolvimento de Software Dirigido a Modelos), analisadores e geradores de código, e conceitos de microsserviços, foi desenvolvido um particionador que distribui o código fonte de uma aplicação em diversos servidores, criando pequenos serviços para cada, fazendo esses serviços trocarem informações entre si, mantendo as funcionalidades da aplicação intactas. O particionador dá flexibilidade ao programador de escolher a disposição das classes entre os serviços que serão criados. Desenvolvedores podem então, facilmente, testar diversas maneiras de distribuir o código de sua aplicação, sem a necessidade de ter que desenvolver os serviços e a comunicação entre eles. Essa abordagem foi denominada distribuição tardia. Estudos experimentais foram realizados para garantir a validade do projeto. No total, cinco testes diferentes foram conduzidos, a fim de verificar se a criação dos serviços seria realizada como definida pelo programador. Em todos os casos o resultado foi satisfatório, permitindo a distribuição do código do software utilizado entre os servidores designados.

Mobilné zariadenia sú v rámci technologickej histórie novinka a pri technológii, ktorá sa vyvíja tak rapídnym tempom a rastom používania je nutné dbať na zabezpečenie. Táto diplomová práca sa zaoberá rozborom bezpečnostných mechanizmov používaných v Android OS a komunikáciou medzi OS Android a vzdialeným serverom. Cieľom je preskúmať tieto mechanizmy a otestovať aké kryptografické metódy a postupy je najvýhodnejšie používať z hľadiska bezpečnosti s ohľadom na efektivitu. Tieto znalosti boli použité pre vytvorenie demonštračného systému, ktorý využíva vybrané zabezpečovacie mechanizmy a kryptografické postupy.

No description available.

The notion of change is one of the more pronounced challenges API developers face, since a change to published APIs means a change for its’ consumers. API Versioning is a commonly used strategy to mitigate the risks of changing APIs, however, the strategy introduces a possibility of having practically innumerable number of API versions published at once, all possibly used by different consumers, creating considerable overhead for API developers to manage. API Versioning and API version management are well-researched disciplines. Nevertheless, Yasmin et al. (2020) have identified a research gap in the support for API consumers to made aware of API deprecations in a proactive and automatic fashion. API Versioning in the context of microservices– which the literature seldom addresses– may serve as an interesting solution space for answering the call of Yasmin et al. (2020), due to the architecture’s strong ties to continuous integration– a practice concerned with automatically and proactively ensuring software quality. Concisely, this thesis is set out to answer Yasmin et al.’s (2020) call for research by utilizing the underexplored contextualization of microservices and continuous integration. Using a Design Science Research strategy, this thesis proposes a model detailing how deprecated RESTful web API version usage can be automatically and proactively detected in microservices using continuous integration. The model is subsequently proven to be instantiable via a proof of concept, designed for and situated at a national Swedish bank. Through a series of in-vitro simulations at the bank, the proof of concept is demonstrated to successfully being able to automatically and proactively detect deprecated RESTful web API version usage. An evaluation of the solution shows that the proof of concept– and by extent the model– fulfills the demarcated research objectives of automaticity, proactivity, generality, and autonomy. Thus, the proposed solution is determined to be both novel and useful, successfully answering the call of Yasmin et al. (2020) in the context of microservices and continuous integration.

Microservices is one of the most commonly used buzzword of the systems architecture industry and is being adopted by several of the world’s largest technology companies such as Netflix, Uber and Amazon. The architecture which embraces splitting up your system in smaller independent units is an extension of the service-oriented architecture and an opponent of the monolithic architecture. Being a top buzzword and promises of extreme scalability has spiked the interest for microservices, but unlike the relatively simple monolithic architecture the complexity of microservices creates a new set of obstacles. This work sheds a light on these issues and implements solutions for some of the most frequent problems using a case study. The study shows that while microservices can help reduce the inner complexity of a system, it greatly increases the outer complexity and creates the need for a variety of tools aimed at distributed systems. It also concludes that communication and data storage are two of the most frequently occurring issues when developing microservices with the most difficult one being how you reason with and structure your data, especially for efficient queries across microservices. / Microservices eller så kallade mikrotjänster är ett ofta förekommande buzzword inom systemarkitektur och nyttjas av flera teknikjättar som exempelvis Netflix, Uber och Amazon. Arkitekturen som bygger på att dela upp sina system i mindre oberoende delar är en utbyggnad av den tjänstorienterade arkitekturen och numera motståndare till den klassiska monolitiska arkitekturen. En plats högt upp på trendlistan och lovord om extrem skalbarhet har gjort att intresset för mikrotjänster är enormt, men till skillnad från den relativt simpla monolitiska arkitekturen skapar komplexiteten hos mikrostjänster en rad nya hinder. Det här arbetet belyser dessa hinder och implementerar även lösningar för de vanligaste förekommande problemen med hjälp av en fallstudie. Resultatet visar att även fast en mikrotjänstarkitektur kan minska systemets interna komplexitet så leder det till en markant ökning av systemets yttre komplexitet och det skapas ytterligare behov av en mängd olika verktyg och tjänster designade för distribuerade system. Studien visar också att de två mest förekommande problemen vid utveckling av en mikrotjänstarkitektur är kommunikation och datalagring där hantering och struktur av data är den mest komplicerade och kräver mycket kunskap, speciellt för att skapa effektiva datasökningar som sträcker sig över flera mikrotjänster.

Security research is beneficial for companies that want their system protected against threats to their business. The focus of this project is on security considerations. These considerations are with regards to when companies want to evaluate the benefits of extracting microservices from their monolithic system. The problem with this task is that extracting microservices have potential effects on security. Changing a systems design could lead to potential security risks which need to be considered. This type of problem is on a high difficulty level because of the amount of abstraction and research required to analyze the system regarding the security aspect. Since the problem requires abstractions and analysis of the system both pre and post-extraction it also becomes a big task to complete. The problem is solved with threat modeling and also by using the National Institute of Standards and Technology guidelines and by measuring The Common Misuse Scoring System scores and Return Of Security Investment costs. The results show an increase in security by allowing a function to become a microservice. The increase mainly came from how access changes with the extracted service. The result also showcased that movements towards the cloud meant more security regarding access when compared to the system before a microservice was extracted. The reasoning being that cloud services could provide more access control surface for functions. With the results, the host company and companies with similar software architecture can see how a function will affect security if extracted into a microservice. Further research should be conducted upon a larger pool of microservices. These should then be examined if the trend of security increase keeps occurring. The results can be further examined with penetration testing which puts more practical work upon the theoretical work that was done in this thesis. The research also showcases the adaptability of the National Institute of Standards and Technology guides steps and how similar research regarding security comparisons can be made. / Säkerhetsforskning är essentiellt för företag som vill skydda sig emot attacker som kan skada deras affärsverksamhet. Med detta i åtanke så fokuserar detta projektet på att undersöka överväganden gällande säkerhet när det kommer till att extrahera mikrotjänster från en monolitisk struktur. Att ändra i ett företags system kan potentiellt påverka säkerheten vilket är ett scenario vars effekter måste säkerhetsklassas. Detta säkerhetsproblemet är ett svårt problem att tackla på grund av mängden abstraktion som behövs göras och även på grund av perspektivet som behövs appliceras på abstraktionen. Då abstraktioner behövs göras på företagets system innan och efter en extraktion är utförd innebär det också att problemet är tidskrävande. Rapporten tacklar problemen genom att använda sig av hotmodellering, specifikt National Institute of Standards and Technology guide i hur man utför hotmodellering. NIST har också ett system för att ge värden till attacker som kallas The Common Misuse Scoring System vilket används i projektet för att producera jämförbara mätvärden. Projektet jämför också beräkningar gällande avkastning på säkerhetsinvesteringar. Resultaten visade att molntjänster kan erbjuda mer säkerhet. Med hjälp av resultaten kan Indicio Technologies AB och företag med samma struktur se hur extrahering av en funktion kan påverka säkerheten. Liknande forskning rekommenderas att utföras på större företag där det finns flera färdiga mikrotjänster. En större mängd av mikrotjänster kan bli utvärderade med samma princip som i denna rapport för att se ifall man alltid kan se en ökning av säkerhet. Rapportens resultat kan undersökas vidare med hjälp av praktiska metoder såsom penetrationstestning där mera praktiskt arbete blir utfört på den teoretiska grund som var satt i denna rapporten. Rapporten visade också på en anpassningsförmåga för National Institute of Standards and Technology guiden.

Microservices have emerged as an attractive alternative to more classical monolithic software application architectures. Microservices provides many benefits that help with code base comprehension, deployability, testability, and scalability. As the Information technology (IT) industry has grown ever larger, it makes sense for the technology giants to adopt the microservice architecture to make use of these benefits. However, with new software solutions come new security vulnerabilities, especially when the technology is new and vulnerabilities are yet to be fully mapped out. Authentication and authorization are the cornerstone of any application that has a multitude of users. However, due to the lack of studies of microservices, stemming from their relatively young age, there are no standardized design patterns for how authentication and authorization are best implemented in a microservice. This thesis investigates an existing microservice in order to secure it by applying what is known as a security design pattern for authentication and authorization. Different security patterns were tested and compared on performance. The differing levels of security provided by these approaches assisted in identifying an acceptable security versus performance trade-off. Ultimately, the goal was to give the patterns greater validity as accepted security patterns within the area of microservice security. Another goal was to find such a security pattern suitable for the given microservice used in this project. The results showed a correlation between increased security and longer response times. For the general case a security pattern which provided internal authentication and authorization but with some trust between services was suggested. If horizontal scaling was used the results showed that normal services proved to be the best target. Further, it was also revealed that for lower user counts the performance penalties were close to equal between the tested patterns. This meant that for the specific case where microservices sees lower amounts of traffic the recommended pattern was the one that implemented the maximum amount access control checks. In the case for the environment where the research were performed low amounts of traffic was seen and the recommended security pattern was therefore one that secured all services of the microservices. / Mikrotjänster har framträtt som ett mer attraktivt alternativ än mer konventionella mjukvaruapplikationsarkitekturer såsom den monolitiska. Mikrotjänster erbjuder flera fördelar som underlättar med en helhetsförståelse för kodbasen, driftsättning, testbarhet, och skalbarhet. Då IT industrin har växt sig allt större, så är det rimligt att tech jättar inför mikrotjänstarkitekturen för att kunna utnyttja dessa fördelar. Nya mjukvarulösningar medför säkerhetsproblem, speciellt då tekniken är helt ny och inte har kartlagts ordentligt. Autentisering och auktorisering utgör grunden för applikationer som har ett flertal användare. Då mikrotjänster ej hunnit blivit utförligt täckt av undersökning, på grund av sin relativt unga ålder, så finns det ej några standardiserade designmönster för hur autentisering och auktorisering är implementerade till bästa effekt i en mikrotjänst. Detta examensarbete undersöker en existerande mikrotjänst för att säkra den genom att applicera vad som är känt som ett säkerhetsdesignmönster för autentisering och auktorisering. Olika sådana mönster testades och jämfördes baserat på prestanda i olika bakgrunder. De varierade nivåerna av säkerhet från de olika angreppssätten som säkerhetsmönstrena erbjöd användes för att identifiera en acceptabel kompromiss mellan säkerhet mot prestanda. Målet är att i slutändan så kommer detta att ge mönstren en högre giltighet när det kommer till att bli accepterade som säkerhetsdesignmönster inom området av mikrotjänstsäkerhet. Ett annat mål var att hitta den bästa kandidaten bland dessa säkerhetsmönster för den givna mikrotjänsten som användes i projektet. Resultaten visade på en korrelation mellan ökad säkerhet och längre responstider. För generella fall rekommenderas det säkerhetsmönster som implementerade intern autentisering och auktorisering men med en viss del tillit mellan tjänster. Om horisontell skalning användes visade resultaten att de normala tjänsterna var de bästa valet att lägga dessa resurser på. Fortsättningsvis visade resultaten även att för ett lägre antal användare så var den negativa effekten på prestandan nästan likvärdig mellan de olika mönstren. Detta innebar att det specifika fallet då mikrotjänster ser en lägre mängd trafik så är det rekommenderade säkerhetsmönstret det som implementerad flest åtkomstkontroller. I fallet för den miljö där undersökningen tog plats förekom det en lägre mängd trafik och därför rekommenderades det säkerhetsmönster som säkrade alla tjänster närvarande i mikrotjänsten.

Microfrontend applications are composed of multiple smaller frontend applications, which are integrated at run-time. As with microservices, microfrontends can be updated in production at any time. There are no technological restrictions for releasing API-breaking updates. Therefore it is difficult to trust microfrontend applications to perform reliably in run-time and to introduce API-breaking updates without the risk of breaking consumers. This thesis presents Plutt, a tool that provides automatic guarantees for safely consuming microfrontends, by ensuring that updates in run-time are compatible. By using Plutt, consumers can be confident that a provided microfrontend will per- form the same during production as in development. Likewise, microfrontend providers can release updates without being concerned about how it will affect consumers. Moreover, a comprehensive survey about microfrontends is presented, where five industry experts are interviewed. Aspects that are not found in existing literature are discovered, which contributes to a broader knowledge base that helps future microfrontend research. / Mikrofrontend-applikationer är sammansatta av flera mindre frontend-applikationer som integreras under exekvering. Precis som med mikrotjänster, kan mikrofrontends bytas ut i produktion när som helst. Det saknas teknologiska restriktioner för att publicera API-brytande uppdateringar. Därför är det svårt att lita på att en mikrofrontend-applikation beter sig tillförlitligt under exekvering samt att introducera API-brytande uppdateringar utan att riskera att förstöra konsumenter. Det här examensarbetet presenterar Plutt, ett verktyg som erbjuder automatiska garantier för att säkert konsumera mikrofrontends genom att säkerställa att uppdateringar som introduceras i körtid är kompatibla. Genom att använda Plutt, kan konsumenter vara trygga i vetskapen att en försedd mikrofrontend presterar likadant under produktion som i utveckling. Samtidigt kan utvecklare som förser mikrofrontends släppa uppdateringar utan att bekymra sig över hur det påverkar konsumenter. Utöver Plutt, presenteras en grundlig kartläggning över mikrofrontends, där fem experter från industrin är intervjuade. Aspekter som inte hittas i existerande litteratur är upptäckta, vilket kunskapsbas och framtida forskning om mikrofrontends.

Цель работы – разработка распределённой системы управления коммуникациями с клиентами под нужды компании АО «Эр-Телеком Холдинг». Объект исследования – класс информационных систем для уведомления пользователей. Методы исследования: анализ, систематизация и обобщения данных о предыдущей версии системы нотификации клиентов, сравнение и анализ инструментов, технологий и принципов построения информационных систем. Результаты работы: разработана система массовой нотификации клиентов.Выпускная квалификационная работа выполнена в текстовом редакторе Microsoft Word и представлена в твёрдой копии. / The goal of the work is to develop a distributed system for managing communications with clients for the needs of ER-Telecom Holding JSC. The object of study is a class of information systems for notifying users. Research methods: analysis, systematization and generalization of data on the previous version of the customer notification system, comparison and analysis of tools, technologies and principles for constructing information systems. Results of work: a system for mass notification of clients has been developed. The final qualifying work was completed in the text editor Microsoft Word and presented in a hard copy.

Alzheimer’s disease (AD) is a neurodegenerative disease and the major cause of dementia, affecting more than 50 million people worldwide. Chronic pain is long-lasting, persistent pain that affects more than 1.5 billion of the world population. Overlapping and heterogenous symptoms of AD and chronic pain conditions complicate their diagnosis, emphasizing the need for more specific biomarkers to improve the diagnosis and understand the disease mechanisms. To characterize disease pathology of AD, we measured the protein changes in the temporal neocortex region of the brain of AD subjects using mass spectrometry (MS). We found proteins involved in exo-endocytic and extracellular vesicle functions displaying altered levels in the AD brain, potentially resulting in neuronal dysfunction and cell death in AD. To detect novel biomarkers for AD, we used MS to analyze cerebrospinal fluid (CSF) of AD patients and found decreased levels of eight proteins compared to controls, potentially indicating abnormal activity of complement system in AD. By integrating new proteomics markers with absolute levels of Aβ42, total tau (t-tau) and p-tau in CSF, we improved the prediction accuracy from 83% to 92% of early diagnosis of AD. We found increased levels of chitinase-3-like protein 1 (CH3L1) and decreased levels of neurosecretory protein VGF (VGF) in AD compared to controls. By exploring the CSF proteome of neuropathic pain patients before and after successful spinal cord stimulation (SCS) treatment, we found altered levels of twelve proteins, involved in neuroprotection, synaptic plasticity, nociceptive signaling and immune regulation. To detect biomarkers for diagnosing a chronic pain state known as fibromyalgia (FM), we analyzed the CSF of FM patients using MS. We found altered levels of four proteins, representing novel biomarkers for diagnosing FM. These proteins are involved in inflammatory mechanisms, energy metabolism and neuropeptide signaling. Finally, to facilitate fast and robust large-scale omics data handling, we developed an e-infrastructure. We demonstrated that the e-infrastructure provides high scalability, flexibility and it can be applied in virtually any fields including proteomics. This thesis demonstrates that proteomics is a promising approach for gaining deeper insight into mechanisms of nervous system disorders and find biomarkers for diagnosis of such diseases.