A flexible, scalable, and asynchronous middleware abstract is needed for business process management, which involves thousands of tasks and a large number of running instances of large business processes. The content-based publish/subscribe system is an ideal candidate to serve as enterprise service bus for these applications. In the publish/subscribe paradigm, information providers called publishers disseminate publications to all subscribers who have expressed interests by registering subscriptions through a loosely coupled interface. However, the traditional publish/subscribe paradigm only supports stateless subscriptions, that is, event correlation is ignored. Moreover, subscribers can only receive publications issued after their subscriptions. There are many application contexts, however, where access to publications from the past is necessary,such as for replaying a business process execution to debug it. Even more interesting uses arise when data from the past can be correlated with those in the future. Therefore, new languages and new functionalities are needed in the standard publish/subscribe model in order to support business process management. A new subscription language PADRES SQL(PSQL) which can express event patterns and unify both historic and future views for subscribers. PADRES allows a subscriber to access data published both in the past and in the future. Furthermore, complex event detection happens in the broker network. The main difficulties of distributed event detection are routing a composite subscription, including where and how to decompose the composite subscription, and routing the individual parts of the subscription. Our composite subscription routing decisions are based on a cost model which minimizes the routing and detection delay. An adaptive subscription routing protocol is proposed to determine efficient location with dynamic changing workloads. PADRES also provides robust message delivery by exploring alternative paths in a cyclic overlay. Routing optimizations and efficient matching algorithms are studied to improve the performance of the extended publish/subscribe model. With the above features, we propose the Ninos system, the distributed business process execution architecture as a case study,which uses light-weight activity agents to carry out business process execution in a distributed environment. Ninos proves that decentralized business process execution is the trend for next generation products, and the publish/subscribe model is ideal to serve as an enterpriser service bus (ESB) for distributed applications.

A flexible, scalable, and asynchronous middleware abstract is needed for business process management, which involves thousands of tasks and a large number of running instances of large business processes. The content-based publish/subscribe system is an ideal candidate to serve as enterprise service bus for these applications. In the publish/subscribe paradigm, information providers called publishers disseminate publications to all subscribers who have expressed interests by registering subscriptions through a loosely coupled interface. However, the traditional publish/subscribe paradigm only supports stateless subscriptions, that is, event correlation is ignored. Moreover, subscribers can only receive publications issued after their subscriptions. There are many application contexts, however, where access to publications from the past is necessary,such as for replaying a business process execution to debug it. Even more interesting uses arise when data from the past can be correlated with those in the future. Therefore, new languages and new functionalities are needed in the standard publish/subscribe model in order to support business process management. A new subscription language PADRES SQL(PSQL) which can express event patterns and unify both historic and future views for subscribers. PADRES allows a subscriber to access data published both in the past and in the future. Furthermore, complex event detection happens in the broker network. The main difficulties of distributed event detection are routing a composite subscription, including where and how to decompose the composite subscription, and routing the individual parts of the subscription. Our composite subscription routing decisions are based on a cost model which minimizes the routing and detection delay. An adaptive subscription routing protocol is proposed to determine efficient location with dynamic changing workloads. PADRES also provides robust message delivery by exploring alternative paths in a cyclic overlay. Routing optimizations and efficient matching algorithms are studied to improve the performance of the extended publish/subscribe model. With the above features, we propose the Ninos system, the distributed business process execution architecture as a case study,which uses light-weight activity agents to carry out business process execution in a distributed environment. Ninos proves that decentralized business process execution is the trend for next generation products, and the publish/subscribe model is ideal to serve as an enterpriser service bus (ESB) for distributed applications.

Content-based publish-subscribe is emerging as a communication paradigm able to meet the demands of highly dynamic distributed applications, such as those made popular by mobile computing and peer-to-peer networks. Nevertheless, the available systems implementing this communication model are still unable to cope efficiently with dynamic changes to the topology of their distributed dispatching infrastructure. This hampers their applicability in the aforementioned scenarios. This thesis addresses this problem and presents a complete approach to the reconfiguration of content-based publish-subscribe systems. In Part I, it proposes a layered architecture for reconfigurable publish-subscribe middleware consisting of an overlay, a routing, and an event-recovery layer. This architecture allows the same routing components to operate in different types of dynamic network environments, by exploiting different underlying overlays. Part II addresses the routing layer with new protocols to manage the recon- figuration of the routing information enabling the correct delivery of events to subscribers. When the overlay changes as a result of nodes joining or leaving the network or as a result of mobility, this information is updated so that routing can adapt to the new environment. Our protocols manage to achieve this with as little overhead as possible. Part III addresses the overlay layer and proposes two novel approaches for building and maintaining a connected topology in highly dynamic network sce- narios. The protocols we present achieve this goal, while managing node degree and keeping reconfigurations localized when possible. These properties allow our overlay managers to be applied not only in the context of publish-subscribe mid- dleware but also as enabling technologies for other communication paradigms like application-level multicast. Finally, the thesis integrates the overlay and routing layers into a single frame- work and evaluates their combined performance both in wired and in wireless scenarios. Results show that the optimizations provided by our routing reconfig- uration protocols allow the middleware to achieve very good performance in such networks. Moreover, they highlight that our overlay layer is able to optimize this performance even further, significantly reducing the network traffic generated by the routing layer. The protocols presented in this thesis are implemented in the REDS middle- ware framework developed at Politecnico di Milano. Their use enables REDS to operate efficiently in dynamic network scenarios ranging from large-scale peer-to- peer to mobile ad hoc networks.

Le routage par clé et par contenu sont des systèmes de routage ou la destination d'un message suit un parcours entre les nœuds du réseau qui dépend seulement du contenu du message même. On peut les trouver utilisés soit dans des systèmes pair-à-pair connus comme Réseaux Overlay Structurés (Structured Overlay Networks, SON), soit dans les architecture internet de nouvelle génération, les Réseaux Centrés sur les Contenus (Content-Centric Networks, CCN). Le but de cette thèse est double. D'un côté, on explore le sujet de l'interconnexion et de la coopération des réseaux d'overlay, et on propose une architecture capable de permettre à plusieurs réseaux d'overlay hétérogènes, avec différentes topologies et différents mécanismes de routage, d'interagir, grâce à une infrastructure basée sur des nœuds passerelles. On montre, par des moyennes de simulation et déploiement dans un réseaux réel, que la solution est scalable et permet un routage quasi-exhaustif avec un nombre relativement bas des nœuds passerelle bien connectés. De plus, on présente deux exemples d'applications qui pourront bénéficier de cette architecture. Dans une deuxième partie, on rentre plutôt dans les possibilités offertes par le routage basé sur les contenus hors sa "zone de confort": d'abord, on analyse les améliorations qu'un réseau d'overlay structuré peut porter à un système de diffusion vidéo pair-à-pair, en termes de qualité du vidéo et de perte des paquets pendant la transmission. Après, on examine un système entièrement centré sur le routage basé sur les contenus, en développant une solution de diffusion vidéo en temps réel dans un réseau CCN. / Key-based and content-based routing are a class of routing techniques where the destination and routing path for a message depends solely on the content of the message itself. This kind of routing has been implemented in certain peer-to-peer systems, known as Structured Overlay Networks (SON), or in the Next Generation Internet architectures, under the name of Content-Centric Networks (CCN). The scope of this thesis is twofold: on the one side, we explore the topic of the interconnection and cooperation of different structured overlays, and propose architecture capable of allowing several heterogeneous overlay networks, with different topologies and different routing schemes, to interact, thanks to a lightweight infrastructure consisting of co-located nodes. Through the use of simulations and real-world deployment, we show how this solution is scalable and how it facilitates quasi-exhaustive routing, with even a relatively low number of well-connected co-located nodes. To address the problem of scaling network design to millions of nodes, we propose a mathematical model capable of deriving basic performance figures for an interconnected system. Furthermore, we present two application examples that could greatly benefit from such architecture. On the other side, we investigate a little further into the capabilities of content-based routing outside of its "comfort zone": first, we analyze the improvement that a SON could bring to a peer-to-peer real-time video streaming system (P2P-TV), in terms of chunk loss and Quality of Experience. Then, we move the approach to a fully content-based domain, implementing the P2P-TV solution on top of Content-Centric Networks.

In dieser Arbeit werden die Mšglichkeiten sicherer Ausgliederung von Datenbanken und inhaltsbasiertem Routing an einen nicht voll vertrauenswŸrdigen Dienstanbieter betrachtet. Wir untersuchen die Grenzen der Sicherheit, die in diesem Szenario erreicht werden kšnnen. Sicherheit wird dabei unter Zuhilfenahme aktueller komplexitŠtstheoretischer Arbeiten definiert. Dies ermšglicht die Verwendung formaler Methoden zur Untersuchung der Bedingungen, unter denen verschiedene Grade von Sicherheit mšglich sind. Die BeitrŠge dieser Dissertation sind im Einzelnen: - Wir untersuchen die Eignung sog. Privacy-Homomorphismen, welche die AusfŸhrung von Operationen auf verschlŸsselten Daten erlauben. Dies dient der Entwicklung von Protokollen zur sicheren Datenbankausgliederung. Weiter beschreiben wir ein allgemeines Framework fŸr sichere Datenbankausgliederung, das auf sog. Volltextsuch-VerschlŸsselungsverfahren basiert. Ferner stellen wir einen Beweis fŸr die Sicherheit und Korrektheit vor. - Wir beschreiben ein neues Volltextsuch-VerschlŸsselungsverfahren, das im Vergleich zu bekannten Arbeiten eine grš§ere Anzahl verschiedener Operationen fŸr das Datenbank-Outsourcing-Problem ermšglicht und signifikant niedrigere Fehlerraten hat. - Wir schlagen einen Ansatz vor, um im Kontext der sicheren Datenbank-Auslagerung Blanko-Zugriffe auf die verschlŸsselten Daten zu verwalten. Verglichen mit existierenden Techniken ist unser Ansatz anwendbar auf generellere Szenarien, ist einfacher und hat Šhnliche Effizienzeigenschaften. - Wir untersuchen die Mšglichkeit des sicheren inhaltsbasierten Routings, in dem wir ein formales Sicherheitsmodell konstruieren, existierende AnsŠtze in diesem Modell bewerten und eine formale Analyse der Mšglichkeit von Vertraulichkeit durchfŸhren. Unser Sicherheitsmodell deckt die UnzulŠnglichkeiten der bestehenden AnsŠtze auf. Schlie§lich beschreiben wir ein inhaltsbasiertes Routingverfahren, welches das Modell erfŸllt. / This thesis considers the possibilities of secure outsourcing of databases and of content-based routing operations to an untrusted service provider. We explore the limits of the security that is achievable in these scenarios. When discussing security, we refer to the state of the art definitions from cryptography and complexity theory. The key contributions of the thesis are the following: - We explore the applicability of cryptographic constructs that allow performing operations over encrypted data, also known as privacy homomorphisms, for creating protocols that could enable secure database outsourcing. We also describe a framework for secure database outsourcing that is based on searchable encryption schemes, and prove its correctness and security. - We describe a new searchable encryption scheme that exceeds existing analogues with regard to certain parameters: compared to the existing works, the proposed scheme allows for performing a larger number of operations over a securely outsourced database and has significantly lower chances of returning erroneous results of a search. - We propose an approach for managing discretionary access to securely outsourced and encrypted databases. Compared to existing techniques, our approach is applicable to more general scenarios, is simpler and has similar performance characteristics. - We examine possibilities of performing a secure content-based routing by building a formal security model that describes a secure content-based routing system, evaluate existing approaches against this model, and provide an analysis of the possibilities for achieving confidentiality when performing the routing. Compared to the existing works, which fail in providing complete confidentiality, our security model considers shortcomings of these solutions. We also describe a content-based routing system that satisfies this model and to the best of our knowledge is the first of its kind to provide a complete confidentiality.

The dissemination of various types of data faces ongoing challenges with the growing need of accessing manifold information. Since the interest in content is what drives data networks, some new technologies and thoughts attempt to cope with these challenges by developing content-based rather than address-based architectures. The Publish/ Subscribe paradigm can be a promising approach toward content-based data dissemination, especially that it provides total decoupling between publishers and subscribers. However, in content-based publish/subscribe systems, subscriptions are expressive and the information is often delivered based on the matched expressive content - which may not deeply alleviate considerable performance challenges. This dissertation explores a hardware solution for disseminating data in content-based publish/subscribe systems. This solution consists of an efficient hardware architecture of an XML/XPath broker that can route information based on content to either other XML/XPath brokers or to ultimate users. A network of such brokers represent an overlay structure for XML content-based publish/subscribe data dissemination systems. Each broker can simultaneously process many XPath subscriptions, efficiently parse XML publications, and subsequently forward notifications that result from high-performance matching processes. In the core of the broker architecture, locates an XML parser that utilizes a novel Skeleton CAM-Based XML Parsing (SCBXP) technique in addition to an XPath processor and a high-performance matching engine. Moreover, the broker employs effective mechanisms for content-based routing, so as subscriptions, publications, and notifications are routed through the network based on content. The inherent reconfigurability feature of the broker’s hardware provides the system architecture with the capability of residing in any FPGA device of moderate logic density. Furthermore, such a system-on-chip architecture is upgradable, if any future hardware add-ons are needed. However, the current architecture is mature and can effectively be implemented on an ASIC device. Finally, this thesis presents and analyzes the experiments conducted on an FPGA prototype implementation of the proposed broker/router. The experiments tackle tests for the SCBXP alone and for two phases of development of the whole broker. The corresponding results indicate the high performance that the involved parsing, storing, matching, and routing processes can achieve.

The dissemination of various types of data faces ongoing challenges with the growing need of accessing manifold information. Since the interest in content is what drives data networks, some new technologies and thoughts attempt to cope with these challenges by developing content-based rather than address-based architectures. The Publish/ Subscribe paradigm can be a promising approach toward content-based data dissemination, especially that it provides total decoupling between publishers and subscribers. However, in content-based publish/subscribe systems, subscriptions are expressive and the information is often delivered based on the matched expressive content - which may not deeply alleviate considerable performance challenges. This dissertation explores a hardware solution for disseminating data in content-based publish/subscribe systems. This solution consists of an efficient hardware architecture of an XML/XPath broker that can route information based on content to either other XML/XPath brokers or to ultimate users. A network of such brokers represent an overlay structure for XML content-based publish/subscribe data dissemination systems. Each broker can simultaneously process many XPath subscriptions, efficiently parse XML publications, and subsequently forward notifications that result from high-performance matching processes. In the core of the broker architecture, locates an XML parser that utilizes a novel Skeleton CAM-Based XML Parsing (SCBXP) technique in addition to an XPath processor and a high-performance matching engine. Moreover, the broker employs effective mechanisms for content-based routing, so as subscriptions, publications, and notifications are routed through the network based on content. The inherent reconfigurability feature of the broker’s hardware provides the system architecture with the capability of residing in any FPGA device of moderate logic density. Furthermore, such a system-on-chip architecture is upgradable, if any future hardware add-ons are needed. However, the current architecture is mature and can effectively be implemented on an ASIC device. Finally, this thesis presents and analyzes the experiments conducted on an FPGA prototype implementation of the proposed broker/router. The experiments tackle tests for the SCBXP alone and for two phases of development of the whole broker. The corresponding results indicate the high performance that the involved parsing, storing, matching, and routing processes can achieve.

Distributed event processing systems suffer from poor scalability and inefficient resource usage caused by load distributions typical in real-world applications. The results of these shortcomings are availability issues, poor system performance, and high operating costs. This thesis proposes three remedies to solve these limitations in content-based publish/subscribe, which is a practical realization of an event processing system. First, we present a load balancing algorithm that relocates subscribers to distribute load and avoid overloads. Second, we propose publisher relocation algorithms that reduces both the load imposed onto brokers and delivery delay experienced by subscribers. Third, we present ``green" resource allocation algorithms that allocate as few brokers as possible while maximizing their resource usage efficiency by reconfiguring the publishers, subscribers, and the broker topology. We implemented and evaluated all of our approaches on an open source content-based publish/subscribe system called PADRES and evaluated them on SciNet, PlanetLab, a cluster testbed, and in simulations to prove the effectiveness of our solutions. Our evaluation findings are summarized as follows. One, the proposed load balancing algorithm is effective in distributing and balancing load originating from a single server to all available servers in the network. Two, our publisher relocation algorithm reduces the average input load of the system by up to 68%, average broker message rate by up to 85%, and average delivery delay by up to 68%. Three, our resource allocation algorithm reduces the average broker message rate even further by up to 92% and the number of allocated brokers by up to 91%.

Distributed event processing systems suffer from poor scalability and inefficient resource usage caused by load distributions typical in real-world applications. The results of these shortcomings are availability issues, poor system performance, and high operating costs. This thesis proposes three remedies to solve these limitations in content-based publish/subscribe, which is a practical realization of an event processing system. First, we present a load balancing algorithm that relocates subscribers to distribute load and avoid overloads. Second, we propose publisher relocation algorithms that reduces both the load imposed onto brokers and delivery delay experienced by subscribers. Third, we present ``green" resource allocation algorithms that allocate as few brokers as possible while maximizing their resource usage efficiency by reconfiguring the publishers, subscribers, and the broker topology. We implemented and evaluated all of our approaches on an open source content-based publish/subscribe system called PADRES and evaluated them on SciNet, PlanetLab, a cluster testbed, and in simulations to prove the effectiveness of our solutions. Our evaluation findings are summarized as follows. One, the proposed load balancing algorithm is effective in distributing and balancing load originating from a single server to all available servers in the network. Two, our publisher relocation algorithm reduces the average input load of the system by up to 68%, average broker message rate by up to 85%, and average delivery delay by up to 68%. Three, our resource allocation algorithm reduces the average broker message rate even further by up to 92% and the number of allocated brokers by up to 91%.

Just as packet switched networks constituted a major breakthrough in our perception of the information exchange in computer networks so have the decoupling properties of publish/subscribe systems revolutionized the way we look at networking in the context of large scale distributed systems. The decoupling of the components of publish/subscribe systems in time, space and synchronization has created an appealing platform for the asynchronous information exchange among anonymous information producers and consumers. Moreover, the content-based nature of publish/subscribe systems provides a great degree of flexibility and expressiveness as far as construction of data flows is considered. However, a number of challenges and not yet addressed issued still exists in the area of the publish/subscribe systems. One active area of research is directed toward the problem of the efficient content delivery in the content-based publish/subscribe networks. Routing of the information based on the information itself, instead of the explicit source and destination addresses poses challenges as far as efficiency and processing times are concerned. Simultaneously, due to their decoupled nature, publish/subscribe systems introduce new challenges with respect to issues related to dependability and fail-awareness. This thesis seeks to advance the field of research in both directions. First it shows the design and implementation of routing algorithms based on the end-to-end systems design principle. Proposed routing algorithms obsolete the need to perform content-based routing within the publish/subscribe network, pushing this task to the edge of the system. Moreover, this thesis presents a fail-aware approach towards construction of the content-based publish/subscribe system along with its application to the creation of the soft state publish/subscribe system. A soft state publish/subscribe system exposes the self stabilizing behavior as far as transient timing, link and node failures are concerned. The result of this thesis is a family of the XSiena content-based publish/subscribe systems, implementing the proposed concepts and algorithms. The family of the XSiena content-based publish/subscribe systems has been a subject to rigorous evaluation, which confirms the claims made in this thesis.