Computer networks are continuously evolving and growing in size and complexity. New technologies are being introduced which further increases the complexity. Net- work Service Orchestration is all about pushing configuration out into the network devices automatically without human intervention. There can be issues that causes the orchestration to fail. In many cases manual operations must be done to recover from the error which is very contradicting since the goal of orchestration is that it should be fully automated. There is some indication that the errors that are being solved manually could be de- tected and handled by a feedback mechanism. This thesis work aimed to build on current insight and if possible, verify that the feedback mechanism is a viable method. After consideration on different ways to solve the research question, the choice fell on creating a test environment where the approach was tested. The test environment was used to investigate if a network orchestration system could be integrated with a feedback mechanism. The result of this project presents a way to automatically de- tect a network failure and send feedback to a Network Service Orchestrator. The or- chestrator is then able to identify and correct the error. / Datornätverk utvecklas kontinuerligt och växer i storlek och komplexitet. Nyteknik införs som ytterligare ökar komplexiteten. Nätverksservice orkestrering handlar om att skicka ut konfiguration automatiskt till enheter i nätverket utan mänsklig in- blandning. Det kan finnas problem som gör att orkestreringen misslyckas. I många fall måste manuella åtgärder utföras för att lösa problemet, vilket är mycket motsä- gelsefullt, eftersom målet med orkestrering är att det ska vara fullt automatiserat. Det finns indikationer på att fel kan detekteras och hanteras av en återkopplings- mekanismen. Detta examensarbete syftar till att bygga på aktuell insikt, och om möj- ligt, verifiera att återkopplingsmekanismen är en möjlig metod. Efter överväganden på vilka olika sätt som projektmålet kunde uppnås föll valet på att skapa en testmiljö där ansatsen kunde testas. Testmiljön användes för att utreda om ett nätverksorkestreringssystem kan integreras med en återkopplings mekanism. Resultat av projektet presenterar ett sätt att automatiskt upptäcka ett nätverksfel och skicka återkoppling till ett nätverksorkestreringssystem. Nätverksorkestreraren kan sedan detektera och åtgärda felet.

Les équipements intelligents, notamment les smartphones, sont la cible de nombreuses attaques de sécurité. Par ailleurs, la mise en œuvre de mécanismes de protection usuels est souvent inadaptée du fait de leurs ressources fortement contraintes. Dans ce contexte, nous proposons d'utiliser des chaînes de fonctions de sécurité qui sont composées de plusieurs services de sécurité, tels que des pare-feux ou des antivirus, automatiquement configurés et déployés dans le réseau. Cependant, ces chaînes sont connues pour être difficiles à valider. Cette difficulté est causée par la complexité de ces compositions qui impliquent des centaines, voire des milliers de règles de configuration. Dans cette thèse, nous proposons l'architecture d'un orchestrateur exploitant la programmabilité des réseaux pour automatiser la configuration et le déploiement de chaînes de fonctions de sécurité. Il est important que ces chaînes de sécurité soient correctes afin d’éviter l'introduction de failles de sécurité dans le réseau. Aussi, notre orchestrateur repose sur des méthodes automatiques de vérification et de synthèse, encore appelées méthodes formelles, pour assurer la correction des chaînes. Notre travail appréhende également l'optimisation du déploiement des chaînes dans le réseau, afin de préserver ses ressources et sa qualité de service. / Smart environments, in particular smartphones, are the target of multiple security attacks. Moreover, the deployment of traditional security mechanisms is often inadequate due to their highly constrained resources. In that context, we propose to use chains of security functions which are composed of several security services, such as firewalls or antivirus, automatically configured and deployed in the network. Chains of security functions are known as being error prone and hard to validate. This difficulty is caused by the complexity of these constructs that involve hundreds and even thousands of configuration rules. In this PhD thesis, we propose the architecture of an orchestrator, exploiting the programmability brought by software defined networking, for the automated configuration and deployment of chains of security functions. It is important to automatically insure that these security chains are correct, before their deployment in order to avoid the introduction of security breaches in the network. To do so, our orchestrator relies on methods of automated verification and synthesis, also known as formal methods, to ensure the correctness of the chains. Our work also consider the optimization of the deployment of chains of security functions in the network, in order to maintain its resources and quality of service.

The Service-Oriented Architecture (SOA) has become one of the most popular approaches to building large-scale network applications. The web service technologies are de facto the default implementation for SOA. Simple Object Access Protocol (SOAP) is the key and fundamental technology of web services. Service composition is a way to deliver complex services based on existing partner services. Service orchestration with the support of Web Services Business Process Execution Language (WSBPEL) is the dominant approach of web service composition. WSBPEL-based service orchestration inherited the issue of interoperability from SOAP, and it was furthermore challenged for performance, scalability, reliability and modifiability. I present an architectural approach for service composition in this thesis to address these challenges. An architectural solution is so generic that it can be applied to a large spectrum of problems. I name the architectural style RESTful Service Composition (RSC), because many of its elements and constraints are derived from Representational State Transfer (REST). REST is an architectural style developed to describe the architectural style of the Web. The Web has demonstrated outstanding interoperability, performance, scalability, reliability and modifiability. RSC is designed for service composition on the Internet. The RSC style is composed on specific element types, including RESTful service composition client, RESTful partner proxy, composite resource, resource client, functional computation and relaying service. A service composition is partitioned into stages; each stage is represented as a computation that has a uniform identifier and a set of uniform access methods; and the transitions between stages are driven by computational batons. RSC is supplemented by a programming model that emphasizes on-demand function, map-reduce and continuation passing. An RSC-style composition does not depend on either a central conductor service or a common choreography specification, which makes it different from service orchestration or service choreography. Four scenarios are used to evaluate the performance, scalability, reliability and modifiability improvement of the RSC approach compared to orchestration. An RSC-style solution and an orchestration solution are compared side by side in every scenario. The first scenario evaluates the performance improvement of the X-Ray Diffraction (XRD) application in ScienceStudio; the second scenario evaluates the scalability improvement of the Process Variable (PV) snapshot application; the third scenario evaluates the reliability improvement of a notification application by simulation; and the fourth scenario evaluates the modifiability improvement of the XRD application in order to fulfil emerging requirements. The results show that the RSC approach outperforms the orchestration approach in every aspect.

Geoinformatics field of science becomes more and more important nowadays. This is not only because it is crucial for industry, but it also plays more important role in consumer electronics than ever before. The ongoing demand for complex solutions gave a rise to SOA1 architecture in enterprise and geographical field. The topic that is currently being studied is interoperability between different geospatial services. This paper makes a proposal for a master thesis that tries to add another way of chaining different geospatial services. It describes the current state of knowledge, possible research gap and then goes into the details on design and execution part. Final stage is the summary of expected outcomes. The result of this proposal is a clearly defined need for a research in the outlined area of knowledge. / Contact details: email: dawidnejman@gmail.com phone: +48 511-139-190

Ce travail de thèse, vise à explorer les problèmes de sécurité et les solutions, dans les environnements réseaux logiciels et virtualisés, avec les deux hypothèses suivantes:(1) Les changements de paradigmes introduits par les réseaux SDN et NFV permettent de développer de nouvelles approches en matière de gestion de la sécurité; (2) L’ensemble des menaces et vulnérabilités dans les environnements NFV/SDN doivent être intégralement pris en compte. Donc, dans une première partie, nous proposons une étude détaillée et complète, du point de vue de la sécurité, des architectures et protocoles SDN/NFV, mais aussi de la gestion et de l’orchestration des fonctions réseaux dans ces environnements (architecture MANO). Plusieurs cas d’usage sont spécifiés et proposés, en guise d’illustrations. Cette première étude a conduit à deux contributions majeures: (1) une architecture complète pour la gestion et l’orchestration de la sécurité (appelé SecMANO) basé sur NFV MANO. SecMANO permet de gérer un ensemble de fonctions service, de mécanismes de sécurité (contrôle d’accès, IDS/IPS, isolation, protection) basées sur un ensemble de règles; (2) une analyse complète des menaces et vulnérabilités dans le contexte NFV, à partir de cinq cas d'usage spécifiques, et des contre-mesures associées. Cette analyse a permis de proposer, une classification (taxonomie) complète et détaillée, des différents types de menace spécifique, associés à un ensemble de recommandations, pour une meilleure sécurité des services NFV. Nous estimons que ces deux premières contributions ouvrent des perspectives de recherche intéressantes, dans le domaine de la sécurité des réseaux NFV/SDN.Cette première étude, nous a amenés à proposer en guise de troisième contribution, une nouvelle architecture pour l’orchestration de fonctions de sécurité dans les environnements virtualisés. Cet orchestrateur de sécurité a été spécifié et développé comme un module d’extension pour les orchestrateurs existants. L’objectif est d’assurer un déploiement dynamique, flexible, à la demande, ainsi qu’une orchestration efficace des différents services de sécurité de base. Plus précisément, un mécanisme de contrôle d’accès, défini et appliqué à partir d’un langage de haut niveau, basé sur les piles "Tacker" (un service OpenStack pour orchestrateur NFV utilisant le modèle de donnés TOSCA), a été prototypé, implanté et testé. Ce prototype, permet de personnaliser et d’adapter dynamiquement, le modèle et la stratégie de contrôle d’accès, pour différents domaines utilisateurs concurrents. Ces domaines de sécurité indépendants, restent potentiellement protégés et isolés, dans les environnements à grande échelle, multi-opérateurs et multi-clouds. Le prototype et les expérimentations menées dans des conditions pratiques, montrent la faisabilité et l'efficacité de l’approche proposé.L’étude proposées dans la première partie, à partir d’une approche "cross-layer", mettent en évidence de nouveaux types de menaces et vulnérabilités et démontrent que dans ces environnements logiciels, virtualisés, la sécurité est l’élément critique. La quatrième contribution (SecSFC) vise à sécuriser et à fiabiliser, la composition et le chaînage de fonctions service (Service Function Chaining, SFC) dans les environnements NFV/SDN. SecSFC s’appuie sur un mécanisme de type "identity-based ordered multisignature" pour garantir les propriétés suivantes: (1) L’authentification de chaque fonction service, associée à une chaîne de fonctions service particulière; (2) La cohérence et le séquencement de l’ensemble des fonctions service associées à une composition ou à un chaînage particulier de fonctions service ("VNF forwarding graph"). L’analyse théorique du modèle proposé "SecSFC" et les résultats expérimentaux, montrent le caractère résilient de l’approche, en particulier face à un certain nombre d’attaques spécifiques (ex. modification des règles ou de la topologie) avec un temps de traitement et une latence, limités / This thesis is intended to explore security issues in the virtualized and software-defined world, and starts with two important hypotheses: (1) SDN and NFV offer plenty of opportunities for us to rethink security management in the new networking paradigms; (2) both legacy and new security threats and vulnerabilities in NFV/SDN enabled environments need to be sufficiently addressed in order to pave the way for their further development and deployment. To validate the hypotheses, we carry out an in-depth study on NFV/SDN from security perspective, including its architecture, management and orchestration (MANO) framework, and use cases, leading to two major contributions, (1) a security management and orchestration framework (called SecMANO) based on NFV MANO, which has the potential to manage a set of policy-driven security mechanisms, such as access control, IDS/IPS, network isolation, data protection; (2) a comprehensive threat analysis on five NFV use cases and the state-of-the-art security countermeasures, resulting in a NFV layer-specific threat taxonomy and a set of security recommendations on securing NFV based services.We believe that both of the two contributions lay down a foundation for security research in NFV/SDN domain. In particular, based on the two contributions, we further develop a security orchestrator as an extension of available NFV orchestrator, with an objective to enabling the basic security functions to be effectively orchestrated and provided as on-demand services to the customers, meanwhile allowing high-level security policies to be specified and enforced in a dynamic and flexible way. Specifically, a software-defined access control paradigm is implemented and prototyped with OpenStack and Tacker (a NFV orchestrator using TOSCA model), which allows the security administrators to dynamically customize the access control models and policies for different tenant domains, eventually achieving flexible and scalable protection across different layers and multiple cloud data centers. Both prototype of concept and real-life experiments on testbed have been carried out, clearly demonstrating the feasibility and effectiveness of our security orchestrator.In addition, as our NFV cross-layer threat taxonomy indicates, a large set of novel threats will be introduced, among which VNF (Virtualized Network Function) is a unique and important asset that deserves careful protection. The fourth contribution of this thesis is therefore devoted to achieving secure and dependable SFC (Service Function Chaining) in NFV and SDN environment. Specifically, an identity-based ordered multisignature scheme called SecSFC is designed and applied to ensure that, (1) each service function involved in a particular service chain is authenticated and legitimate; (2) all the service functions are chained in a consistent, optimal, and reliable way, meeting with the pre-defined high-level specifications like VNF Forwarding Graph. Both theoretical security analysis and experimental results demonstrate that our scheme can effectively defend against a large set of destructive attacks like rule modification and topology tempering, moving an important step towards secure and dependable SFC. Importantly, the signature construction and validation process is lightweight, generating compact and constant-size keys and signatures, thereby only incurring minimal computational overhead and latency

Computer networks are continuously evolving and growing in size and complexity. New technologies are being introduced which further increases the complexity. Net- work Service Orchestration is all about pushing configuration out into the network devices automatically without human intervention. There can be issues that causes the orchestration to fail. In many cases manual operations must be done to recover from the error which is very contradicting since the goal of orchestration is that it should be fully automated. There is some indication that the errors that are being solved manually could be de- tected and handled by a feedback mechanism. This thesis work aimed to build on current insight and if possible, verify that the feedback mechanism is a viable method. After consideration on different ways to solve the research question, the choice fell on creating a test environment where the approach was tested. The test environment was used to investigate if a network orchestration system could be integrated with a feedback mechanism. The result of this project presents a way to automatically de- tect a network failure and send feedback to a Network Service Orchestrator. The or- chestrator is then able to identify and correct the error. / Datornätverk utvecklas kontinuerligt och växer i storlek och komplexitet. Nyteknik införs som ytterligare ökar komplexiteten. Nätverksservice orkestrering handlar om att skicka ut konfiguration automatiskt till enheter i nätverket utan mänsklig in- blandning. Det kan finnas problem som gör att orkestreringen misslyckas. I många fall måste manuella åtgärder utföras för att lösa problemet, vilket är mycket motsä- gelsefullt, eftersom målet med orkestrering är att det ska vara fullt automatiserat. Det finns indikationer på att fel kan detekteras och hanteras av en återkopplings- mekanismen. Detta examensarbete syftar till att bygga på aktuell insikt, och om möj- ligt, verifiera att återkopplingsmekanismen är en möjlig metod. Efter överväganden på vilka olika sätt som projektmålet kunde uppnås föll valet på att skapa en testmiljö där ansatsen kunde testas. Testmiljön användes för att utreda om ett nätverksorkestreringssystem kan integreras med en återkopplings mekanism. Resultat av projektet presenterar ett sätt att automatiskt upptäcka ett nätverksfel och skicka återkoppling till ett nätverksorkestreringssystem. Nätverksorkestreraren kan sedan detektera och åtgärda felet.

Orientador: Edmundo Roberto Mauro Madeira / Dissertação (mestrado) - Universidade Estadual de Campinas, Instituto de Computação / Made available in DSpace on 2018-08-09T05:05:03Z (GMT). No. of bitstreams: 1 Nakai_AlanMassaru_M.pdf: 7384395 bytes, checksum: 7ae9dd61b3367851a744bc93622be309 (MD5) Previous issue date: 2007 / Resumo: Uma cadeia produtiva é definida como o conjunto de atividades envolvidas na criação, transformação e distribuição de um produto, da matéria-prima ao consumidor final. Os participantes da cadeia produtiva podem trabalhar de forma integrada, com o objetivo de otimizar o desempenho coletivo, aumentando sua competitividade comercial. Do ponto de vista tecnológico, a natureza distribuída, autônoma e heterogênea dos participantes da cadeia produtiva dificultam a automação dos seus processos de negócio interorganizacionais. Este trabalho propõe uma infra-estrutura baseada em coreografias de serviços Web para coordenar as atividades que compõem os processos de negócio interorganizacionais das cadeias produtivas. Esta infra-estrutura implementa um modelo de coordenação que visa facilitar o projeto e a implantação dos processos de negócio interorganizacionais. Neste modelo, os processos são representados por coreografias WS-CDL, que são mapeadas para planos de coordenação executáveis descritos em BPEL. O trabalho também apresenta um protótipo da infra-estrutura, com o objetivo de validá-la / Abstract: A supply chain is the set of activities involved in the creation, transformation and distribution of a product, from raw material to the consumer. Supply chain's participants can work in an integrated way to optimize their performance and increase their commercial competitiveness. From the technological point of view, the distributed, autonomous and heterogeneous nature of supply chain's participants raises di±culties when we consider the automation of interorganizational processes. This work proposes an infrastructure based on Web services choreographies for coordination of the activities that compose the interorganizational business processes of the supply chains. This infrastructure implements a coordination model that aims to make easier the design and the deployment of the interorganizational business processes. In this model, processes are represented by WS-CDL choreographies, which are mapped to executable BPEL coordination plans. The work also presents a prototype of the infrastructure to validate it / Mestrado / Sistemas Distribuidos / Mestre em Ciência da Computação

La technologie et les conducteurs socio-économiques créent les conditions d'une transformation profonde, appelée "Softwarization", du Telco et des TIC. Réseaux définis par logiciel et réseau Fonctions de virtualisation sont deux des principales technologies permettant ouvrant la voie à cette transformation. Softwarization permettra de virtualiser toutes les fonctions de réseau et de services d'une infrastructure de Telco et de les exécuter sur une plates-formes logicielles, entièrement découplés de l'infrastructure physique sous (presque basé sur du matériel standard). Tous les services seront fournis en utilisant un «continuum» des ressources virtuelles (traitement, de stockage et de communication) avec un investissement en capital initial pratiquement très limité et avec des coûts d'exploitation modestes. 5G sera la première exploitation de Softwarization. 5G sera une infrastructure distribuée massivement dense, intégrant le traitement, le stockage et (fixes et radio) des capacités de mise en réseau. En résumé, l'objectif général de cette thèse a étudié les défis techniques et les opportunités d'affaires apportées par le "Softwarization" et 5G. En particulier, la thèse propose que le 5G devra avoir une sorte de système d'exploitation (5GOS) capable de fonctionner les RAN et de base et les infrastructures fixes convergés. Les contributions de cette thèse ont été: 1) définir une vision pour les futures infrastructures 5G, des scénarios, des cas d'utilisation et les exigences principales: 2) définissant l'architecture fonctionnelle d'un système d'exploitation pour 5G; 3) la conception de l'architecture logicielle d'un 5GOS pour le "bord Cloud"; 4) comprendre les impacts technico-économiques de la vision et 5GOS, et les stratégies les plus efficaces pour l'exploiter / Technology and socio-economic drivers are creating the conditions for a profound transformation, called “Softwarization”, of the Telco and ICT. Software-Defined Networks and Network Functions Virtualization are two of the key enabling technologies paving the way towards this transformation. Softwarization will allow to virtualize all network and services functions of a Telco infrastructure and executing them onto a software platforms, fully decoupled from the underneath physical infrastructure (almost based on standard hardware). Any services will be provided by using a “continuum” of virtual resources (processing, storage and communications) with practically very limited upfront capital investment and with modest operating costs. 5G will be the first exploitation of Softwarization. 5G will be a massively dense distributed infrastructure, integrating processing, storage and (fixed and radio) networking capabilities. In summary, the overall goal of this thesis has been investigating technical challenges and business opportunities brought by the “Softwarization” and 5G. In particular, the thesis proposes that the 5G will have to have a sort of Operating System (5GOS) capable of operating the converged fixed and RAN and core infrastructures. Main contributions of this thesis have been: 1) defining a vision for future 5G infrastructures, scenarios, use-cases and main requirements; 2) defining the functional architecture of an Operating System for 5G; 3) designing the software architecture of a 5G OS for the “Edge Cloud”; 4) understanding the techno-economic impacts of the vision and 5GOS, and the most effective strategies to exploit it

Nous proposons dans cette thèse les approches de test pour la composition de services web. Nous nous intéressons aux test unitaire et d’intégration d’une orchestration de services web. L’aspect de vérification d’exécution en-ligne est aussi consideré. Nous définissons une plateforme de test unitaire pour l’orchestration de services web qui compose une architecture de test, une relation de conformité et deux approches de test basés sur le modèle de machine à l’états finis étendues temporisés: l’approche offline où les activités de test comme la génération de cas de test temporisé, l’exécution de test et l’assignement de verdict sont appliquées en séquentielle tandis que ces activités sont appliquées en parallèle dans l’approche online. Pour le test d’intégration d’une orchestration, nous combinons deux approches: active et passive.Au debut, l’approche active est utilisée pour activer une nouvelle session d’orchestration par l’envoi d’un message de requête SOAP. Après, tous les messages d’entré et de sortie de l’orchestration sont collectés et analysés par l’approche passive.Pour l’aspect de vérification d’exécution en-ligne, nous nous intéressons à la vérification d’une trace qui respecte un ensemble des constraintes, noté règles, ou pas. Nous avons proposé extendre le langage Nomad en définissant des constraintes sur chaque action atomique et un ensemble de corrélation de données entre les actions pour définir des règles pour le service web. Ce langage nous permet de définir des règles avec le temps futur et passé, et d’utiliser des opérations NOT, AND, OR pour combiner quelque conditions dans le contexte de la règle. Ensuite, nous proposons un algorithme pour vérifier l’exactitude d’une séquence des messages en parallèle avec le moteur de collecte de trace. / In this thesis, we propose the testing approaches for web service composition. We focus on unit, integrated testing of an orchestration of web services and also the runtime verification aspect. We defined an unit testing framework for an orchestration that is composed of a test architecture, a conformance relation and two proposed testing approaches based on Timed Extended Finite State Machine (TEFSM) model: offline which test activities as timed test case generation, test execution and verdict assignment are applied in sequential, and online which test activities are applied in parallel. For integrated testing of an orchestration, we combines of two approaches: active and passive. Firstly, active approach is used to start a new session of the orchestration by sending a SOAP request. Then all communicating messages among services are collected and analyzed by a passive approach. On the runtime verification aspect, we are interested in the correctness of an execution trace with a set of defined constraints, called rules. We have proposed to extend the Nomad language, by defining the constraints on each atomic action (fixed conditions) and a set of data correlations between the actions to define the rules for web services. This language allows us to define a rule with future and past time, and to use the operations: NOT, AND, OR to combines some conditions into a context of the rule. Afterwards, we proposed an algorithm to check correctness of a message sequence in parallel with the trace collection engine. Specifically, this algorithm verifies message by message without storing them.

Made available in DSpace on 2014-12-17T15:48:07Z (GMT). No. of bitstreams: 1 DanielASC_DISSERT.pdf: 2076393 bytes, checksum: fb34be082f79ab29b3f4ace6f22d195c (MD5) Previous issue date: 2013-01-31 / Universidade Federal do Rio Grande do Norte / Web services are software accessible via the Internet that provide functionality to be used by applications. Today, it is natural to reuse third-party services to compose new services. This process of composition can occur in two styles, called orchestration and choreography. A choreography represents a collaboration between services which know their partners in the composition, to achieve the service s desired functionality. On the other hand, an orchestration have a central process (the orchestrator) that coordinates all application operations. Our work is placed in this latter context, by proposing an abstract model for running service orchestrations. For this purpose, a graph reduction machine will be defined for the implementation of service orchestrations specified in a variant of the PEWS composition language. Moreover, a prototype of this machine (in Java) is built as a proof of concept / Servi?os web s?o software acess?veis atrav?s da Internet que disponibilizam funcionalidades a serem usadas por aplica??es. Hoje, ? natural reutilizar servi?os de terceiros para compor novos servi?os. Este processo de composi??o pode acontecer em dois estilos, denominados orquestra??o e coreografia. A coreografia representa uma colabora??o entre servi?os os quais conhecem a aplica??o ? qual pertencem e o momento exato para executarem. J? a orquestra??o possui um processo central, o orquestrador, que coordena todas as opera??es da aplica??o. ? neste contexto que este trabalho se encaixa, propondo um modelo abstrato para a execu??o de orquestra??es de servi?os. Com esta finalidade, ser? definida uma m?quina de redu??o de grafos para a implementa??o de orquestra??es de servi?os especificadas em uma variante da linguagem de composi??o PEWS. Ademais, um prot?tipo desta m?quina (em Java) ser? constru?do como prova de conceito