In this dissertation, we address the problem of vagueness in traditional legal contracts by presenting novel methodologies that aid in the paradigm shift from traditional legal contracts to smart contracts. We discuss key enabling technologies that assist in converting the traditional natural language legal contract, which is full of vague words, phrases, and sentences to the blockchain-based precise smart contract, including metrics evaluation during our conversion experiment. To address the challenge of this contract-transformation process, we propose four novel proof-of-concept approaches that take vagueness and different possible interpretations into significant consideration, where we experiment with popular vendors' existing vague legal contracts. We show through experiments that our proposed methodologies are able to study the degree of vagueness in every interpretation and demonstrate which vendor's translated-smart contract can be more accurate, optimized, and have a lesser degree of vagueness. We also incorporated the method of fuzzy logic inside the blockchain-based smart contract, to successfully model the semantics of linguistic expressions. Our experiments and results show that the smart contract with the higher degrees of truth can be very complex technically but more accurate at the same time. By using fuzzy logic inside a smart contract, it becomes easier to solve the problem of contractual ambiguities as well as expedite the process of claiming compensation when implemented in a blockchain-based smart contract.

Information technology has become increasingly important to individuals and organizations alike. Not only does IT allow us to do what we always did faster and more effectively, but it also allows us to do new things, organize ourselves differently, and work in ways previously unimaginable. However, these advantages come at a cost: as we become increasingly dependent upon IT services, we also demand that they are continuously and uninterruptedly available for use. Despite advances in reliability engineering, the complexity of today's increasingly integrated systems offers a non-trivial challenge in this respect. How can high availability of enterprise IT services be maintained in the face of constant additions and upgrades, decade-long life-cycles, dependencies upon third-parties and the ever-present business-imposed requirement of flexible and agile IT services? The contribution of this thesis includes (i) an enterprise architecture framework that offers a unique and action-guiding way to analyze service availability, (ii) identification of causal factors that affect the availability of enterprise IT services, (iii) a study of the use of fault trees for enterprise architecture availability analysis, and (iv) principles for how to think about availability management. This thesis is a composite thesis of five papers. Paper 1 offers a framework for thinking about enterprise IT service availability management, highlighting the importance of variance of outage costs. Paper 2 shows how enterprise architecture (EA) frameworks for dependency analysis can be extended with Fault Tree Analysis (FTA) and Bayesian networks (BN) techniques. FTA and BN are proven formal methods for reliability and availability modeling. Paper 3 describes a Bayesian prediction model for systems availability, based on expert elicitation from 50 experts. Paper 4 combines FTA and constructs from the ArchiMate EA language into a method for availability analysis on the enterprise level. The method is validated by five case studies, where annual downtime estimates were always within eight hours from the actual values. Paper 5 extends the Bayesian prediction model from paper 3 and the modeling method from paper 4 into a full-blown enterprise architecture framework, expressed in a probabilistic version of the Object Constraint Language. The resulting modeling framework is tested in nine case studies of enterprise information systems. / Informationsteknik blir allt viktigare för både enskilda individer och för organisationer. IT låter oss inte bara arbeta snabbare och effektivare med det vi redan gör, utan låter oss också göra helt nya saker, organisera oss annorlunda och arbeta på nya sätt. Tyvärr har dessa fördelar ett pris: i takt med att vi blir alltmer beroende av IT-tjänster ökar också våra krav på att de är ständigt tillgängliga för oss, utan avbrott. Trots att tillförlitlighetstekniken går framåt utgör dagens alltmer sammankopplade system en svår utmaning i detta avseende. Hur kan man säkerställa hög tillgänglighet hos IT-tjänster som ständigt byggs ut och uppgraderas, som har livscykler på tiotals år, som är beroende av tredjepartsleverantörer och som dessutom måste leva upp till verksamhetskrav på att vara flexibla och agila? Den här avhandlingen innehåller (i) ett arkitekturramverk som på ett unikt sätt kan analysera IT-tjänsters tillgänglighet och ta fram rekommenderade åtgärder, (ii) ett antal identifierade kausalfaktorer som påverkar IT-tjänsters tillgänglighet, (iii) en studie av hur felträd kan användas för arkitekturanalys av tillgänglighet samt (iv) en uppsättning principer för beslutsfattande kring tillgänglighet. Avhandlingen är en sammanläggningsavhandling med fem artiklar. Artikel 1 innehåller ett konceptuellt ramverk för beslutsfattande kring IT-tjänsters tillgänglighet som understryker vikten av variansen hos nertidskostnaderna. Artikel 2 visar hur ramverk för organisationsövergripande arkitektur (s.k. enterprise architecture -- EA) kan utvidgas med felträdsanalys (FTA) och bayesianska nätverk (BN) för analys av beroenden mellan komponenter. FTA och BN är bägge etablerade metoder för tillförlitlighets- och tillgänglighetsmodellering. Artikel 3 beskriver en bayesiansk prediktionsmodell för systemtillgänglighet, baserad på utlåtanden från 50 experter. Artikel 4 kombinerar FTA med modelleringselement från EA-ramverket ArchiMate till en metod för tillgänglighetsanalys på verksamhetsnivå. Metoden har validerats i fem fallstudier, där de estimerade årliga nertiderna alltid låg inom åtta timmar från de faktiska värdena. Artikel 5 utvidgar den bayesianska prediktionsmodellen från artikel 3 och modelleringsmetoden från artikel 4 till ett fullständigt EA-ramverk som uttrycks i en probabilistisk version av Object Constraint Language (OCL). Det resulterande modelleringsramverket har testats i nio fallstudier på verksamhetsstödjande IT-system. / <p>QC 20120912</p>

The recent emergence and rapid advancement of Cloud Computing (CC) infrastructure and services have made outsourcing Information Technology (IT) and digital services to Cloud Providers (CPs) attractive. Cloud offerings enable reduction in IT resources (hardware, software, services, support, and staffing), and provide flexibility and agility in resource allocation, data and resource delivery, fault-tolerance, and scalability. However, the current standards and guidelines adopted by many CPs are tailored to address functionality (such as availability, speed, and utilization) and design requirements (such as integration), rather than protection against cyber-attacks and associated security issues. In order to achieve sustainable trust for cloud services with minimal risks and impact on cloud customers, appropriate cloud information security models are required. The research described in this dissertation details the processes adopted for the development and implementation of an integrated information security cloud based approach to cloud service models. This involves detailed investigation into the inherent information security deficiencies identified in the existing cloud service models, service agreements, and compliance issues. The research conducted was a multidisciplinary in nature, with detailed investigations on factors such as people, technology, security, privacy, and compliance involved in cloud risk assessment to ensure all aspects are addressed in holistic and well-structured models. The primary research objectives for this dissertation are investigated through a series of scientific papers centered on these key research disciplines. The assessment of information security, privacy, and compliance implementations in a cloud environment is described in Chapters two, three, four, and five. Paper 1 (CCIPS: A Cooperative Intrusion Detection and Prevention Framework for Cloud Services) outlines a framework for detecting and preventing known and zero-day threats targeting cloud computing networks. This framework forms the basis for implementing enhanced threat detection and prevention via behavioral and anomaly data analysis. Paper 2 (A Trusted CCIPS Framework) extends the work of cooperative intrusion detection and prevention to enable trusted delivery of cloud services. The trusted CCIPS model details and justifies the multi-layer approach to enhance the performance and efficiency of detecting and preventing cloud threats. Paper 3 (SOCaaS: Security Operations Center as a Service for Cloud Computing Environments) describes the need for a trusted third party to perform real-time monitoring of cloud services to ensure compliance with security requirements by suggesting a security operations center system architecture. Paper 4 (SecSLA: A Proactive and Secure Service Level Agreement Framework for Cloud Services) identifies the necessary cloud security and privacy controls that need to be addressed in the contractual agreements, i.e. service level agreements (SLAs), between CPs and their customers. Papers five, six, seven, and eight (Chapters 6 – 9) focus on addressing and reducing the risk issues resulting from poor assessment to the adoption of cloud services and the factors that influence such as migration. The investigation of cloud-specific information security risk management and migration readiness frameworks, detailed in Paper 5 (An Effective Risk Management Framework for Cloud Computing Services) and Paper 6 (Information Security, Privacy, and Compliance Readiness Model) was achieved through extensive consideration of all possible factors obtained from different studies. An analysis of the results indicates that several key factors, including risk tolerance, can significantly influence the migration decision to cloud technology. An additional issue found during this research in assessing the readiness of an organization to move to the cloud is the necessity to ensure that the cloud service provider is actually with information security, privacy, and compliance (ISPC) requirements. This investigation is extended in Paper 7 (A Practical Life Cycle Approach for Cloud based Information Security) to include the six phases of creating proactive cloud information security systems beginning with initial design, through the development, implementation, operations and maintenance. The inherent difficulty in identifying ISPC compliant cloud technology is resolved by employing a tracking method, namely the eligibility and verification system presented in Paper 8 (Cloud Services Information Security and Privacy Eligibility and Verification System). Finally, Paper 9 (A Case Study of Migration to a Compliant Cloud Technology) describes the actual implementation of the proposed frameworks and models to help the decision making process faced by the Saudi financial agency in migrating their IT services to the cloud. Together these models and frameworks suggest that the threats and risks associated with cloud services are continuously changing and more importantly, increasing in complexity and sophistication. They contribute to making stronger cloud based information security, privacy, and compliance technological frameworks. The outcomes obtained significantly contribute to best practices in ensuring information security controls are addressed, monitoring, enforced, and compliant with relevant regulations. / Graduate / 0984 / 0790 / fahd333@gmail.com

The research initiatives addressed in this thesis are geared towards improving the performance of passive optical networks (PONs) through the development of advanced dynamic bandwidth allocation (DBA) protocols. In particular, the aim of the research undertaken is to enhance the quality of service (QoS) offered by standard PONs by means of providing subscribers with service level agreement (SLA) to fulfil applications and associated bandwidth requirements on demand. To accomplish the research objectives, a novel service and bandwidth focused DBA protocol is developed for standard time division multiplexing (TDM), gigabit-capable PONs (GPONs) by flexibly assigning a guaranteed minimum bandwidth to each optical network unit (ONU),terminated at subscribers premises. Modelling and simulation of the developed algorithms have displayed a tenfold enhancement in network performance, showing a superior performance to other published DBA protocols, in terms of mean packet delay. To accomplish protocol optimisation, the ONU upstream transmission properties of TDM-PONs have been further analysed and subsequently the ONU data transfer order in each communication cycle has been dynamically configured to increase the network upstream throughput by overlapping the upstream transmission period with parts of the bandwidth request-allocation process between OLT and ONUs. In addition, with the objective of extending the application of the developed protocol to long-reach PONs by means of reducing the augmented propagation delays due to the network’s extensive reach, the concept of virtual communication cycles has been incorporated into the optimised DBA algorithm. This approach demonstrates comparable transmission efficiency in the context of subscriber throughput and packet delay as in a standard PON but at much longer distances from the network exchange. To overcome the inevitably limited communication capacity of single wavelength TDM protocols and with the transportation of the ever increasing, time-sensitive, multi-media services in mind, a novel multi-wavelength DBA protocol is then developed to be applied to a wavelength division multiplexing–PON. With this protocol, both the downstream and upstream network capacity is dynamically adjusted according to subscribers’ service level and bandwidth demand in each polling cycle as opposed to a fixed upstream network capacity in TDM-PONs. It therefore also demonstrates improved upstream transmission efficiency.

Uma das principais características dos sistemas de informação e de comunicação é permitir que os usuários finais utilizem e disponibilizem serviços interativos com conteúdo multimídia a qualquer hora, em qualquer lugar, com qualquer dispositivo e em movimento, independentemente da tecnologia de rede utilizada. Um desafio que surge face a essa nova característica dos serviços é como identificar os requisitos de QoS (Qualidade de Serviço) fim-a-fim sob a ótica do usuário final em um ambiente convergente e heterogêneo com o intuito de evoluir as relações entre o usuário final e o Provedor de Serviços para o estabelecimento de um contrato com níveis de serviço personalizado. Este trabalho apresenta uma pesquisa para a elaboração de uma ferramenta genérica e aberta para mapear a qualidade percebida pelo usuário em requisitos técnicos de QoS através da captura do fluxo de pacotes gerado entre as aplicações que compõem um serviço e simula atrasos, jitter, perdas e banda percebida com o objetivo de permitir ao usuário final identificar e expressar os valores desses parâmetros tornando transparente os aspectos tecnológicos que envolvem esta identificação. A definição de um ambiente de simulação que hospeda o serviço, o desenvolvimento de um simulador de QoS específico e uma nova relação entre o usuário e o Provedor de Serviços também são abordados. / One of the main characteristics of communication and information systems is to allow final users to use and make available multimedia content interactive services at any time, anywhere, in motion and using any device regardless of network technology. Under this perspective a challenge arises on how to identify the QoS (Quality of Service) requirements in a convergent and heterogeneous environment end-to-end user centric way, in order to evolve the relationship between users and service providers aiming the establishment of personalized demands through personalized agreements. This work presents a study for the development of an open and generic tool for mapping the user perceived quality in QoS requirements through the capture of the packet flow generated between the applications of a service and simulates delays, jitter, loss of packets and bandwidth in order to allow the end user to identify and express the values of these parameters making transparent all the technological aspects involved in this identification. The definition of a service simulation environment, the development of a QoS simulator and a new relationship between users and services providers are also addressed.

Coreografias de serviços Web representam uma forma mais escalável e flexível de compor serviços do que uma abordagem centralizada como a orquestração, e seu papel na integração e comunicação de sistemas de larga escala é vital para os objetivos da SOC (Computação Orientada a Serviços) e da Internet do Futuro. Atualmente coreografias de serviços Web possuem vários desafios de pesquisa, dos quais a qualidade de serviço (QoS) e o monitoramento de coreografias de serviçosWeb são linhas importantes. O objetivo deste trabalho é propor e implementar um mecanismo de monitoramento não intrusivo de coreografias de serviços Web baseado em SLAs (Acordos de Nível de Serviço) que especificam as restrições de atributos de QoS de maneira probabilística. Esta dissertação propõe um mecanismo para coreografias de serviços Web que: (1) define requisitos de QoS; (2) especifica contratos probabilísticos sobre parâmetros de QoS usando SLA; e (3) realiza um monitoramento não intrusivo de coreografias de serviços Web para detectar violações de SLA. / Web services choreographies are a more scalable and flexible way to compose services than a centralized approach like orchestrations, and its role in the integration and communication of large-scale systems is vital for the goals of SoC (Service Oriented Computing) and Future Internet. Currently,Web services choreographies have several research challenges. From all challenges, quality of service (QoS) and monitoring of Web services choreography are important research lines. The goal of this work is to propose and implement a mechanism for non-intrusive monitoring of Web services choreography based on SLAs (Service Level Agreements) that define constraints of QoS attributes in a probabilistic way. This thesis proposes a mechanism for Web services choreographies that:(1) defines QoS requirements; (2) specifies probabilistic contracts on QoS parameters using SLAs; and (3) monitors, non-intrusively, the enactment of Web services choreographies to detect SLA violations.

Uma das principais características dos sistemas de informação e de comunicação é permitir que os usuários finais utilizem e disponibilizem serviços interativos com conteúdo multimídia a qualquer hora, em qualquer lugar, com qualquer dispositivo e em movimento, independentemente da tecnologia de rede utilizada. Um desafio que surge face a essa nova característica dos serviços é como identificar os requisitos de QoS (Qualidade de Serviço) fim-a-fim sob a ótica do usuário final em um ambiente convergente e heterogêneo com o intuito de evoluir as relações entre o usuário final e o Provedor de Serviços para o estabelecimento de um contrato com níveis de serviço personalizado. Este trabalho apresenta uma pesquisa para a elaboração de uma ferramenta genérica e aberta para mapear a qualidade percebida pelo usuário em requisitos técnicos de QoS através da captura do fluxo de pacotes gerado entre as aplicações que compõem um serviço e simula atrasos, jitter, perdas e banda percebida com o objetivo de permitir ao usuário final identificar e expressar os valores desses parâmetros tornando transparente os aspectos tecnológicos que envolvem esta identificação. A definição de um ambiente de simulação que hospeda o serviço, o desenvolvimento de um simulador de QoS específico e uma nova relação entre o usuário e o Provedor de Serviços também são abordados. / One of the main characteristics of communication and information systems is to allow final users to use and make available multimedia content interactive services at any time, anywhere, in motion and using any device regardless of network technology. Under this perspective a challenge arises on how to identify the QoS (Quality of Service) requirements in a convergent and heterogeneous environment end-to-end user centric way, in order to evolve the relationship between users and service providers aiming the establishment of personalized demands through personalized agreements. This work presents a study for the development of an open and generic tool for mapping the user perceived quality in QoS requirements through the capture of the packet flow generated between the applications of a service and simulates delays, jitter, loss of packets and bandwidth in order to allow the end user to identify and express the values of these parameters making transparent all the technological aspects involved in this identification. The definition of a service simulation environment, the development of a QoS simulator and a new relationship between users and services providers are also addressed.

Business Administration, Business Process and Supply Chain Management Degree Project (master), 15 higher education points, 4FE06E, Spring 2013 Authors: Jeremy Bellina, Olegs Bodins, Soeren Krieger and Mathilde Olivier Tutor: Roger Stokkedal Title: Managing Upstream Supply Chain in Order to Decrease Inventory Level: A Case Study on the Paper Merchant Papyrus Sweden. Background: The research is based on Papyrus Sweden, a paper merchant, which is facing a decrease in the demand of paper products. It was identified that inventory level reduction is now crucial for the company in order to stay in the market. Therefore, Papyrus Sweden is focused on inventory level and tied-up capital reduction in order to decrease costs and increase net profit. Purpose: This thesis aims to analyze the current situation in Papyrus Sweden in terms of inventory level and activities related to suppliers, and prepare recommendations which could help Papyrus Sweden to reduce its inventory level. Method: The data has been collected through interviews with managers from the supply chain department as well as through a data sample from Papyrus Sweden database given to the researchers. All data was analyzed and compared with the literature review. Data received from the database was processed and transformed in Microsoft Excel in order to make the analysis. Results: The analysis identifies issues in material planning methods, safety stock calculation, ABC-XYZ classification and forecast calculation, on which Papyrus Sweden could act in order to decrease its inventory level. Furthermore, the researchers identify two solutions Papyrus Sweden could implement with its suppliers in order to reduce inventory level which are a Service Level Agreement and a Vendor Managed Inventory system. Keywords: inventory level, material planning method, safety stock, ABC-XYZ classification, forecast calculation, replenishment lead time, supplier relationship, information sharing, Service Level Agreement (SLA), Vendor Managed Inventory (VMI) and Collaborative planning, forecast and replenishment system (CPFR).

[pt] Minimizar as dificuldades de comunicação entre áreas técnicas de TI e áreas de Negócio tem sido um desafio de muitos CIOs - Chief Information Officers - de empresas, que têm que traduzir as necessidades de diversas Unidades de Negócio da empresa em tecnologias adequadas, integradas, escaláveis e geradoras de receita para as organizações. Dado que TI não é um fim em si mesma, mas um meio para que a organização atinja resultados, tal disputa pode desembocar em ineficiência, a despeito dos investimentos e esforços despendidos. As percepções sobre os possíveis conflitos envolvendo a área de TI e seus clientes internos, em duas empresas de telecomunicações brasileiras, são contraditórias ou coincidentes, de acordo com a visão de cada uma das áreas? Quais as causas destes possíveis conflitos identificadas em cada uma das empresas? / [en] Minimize the difficulties of communication between technical areas of IT and Business areas has been a challenge to many CIOs – Chief Information Officers - of companies that have to translate the needs of Business units of the company in appropriate technologies, integrated, scalable and generating revenue for organizations. Since IT is not an end in itself, but a step that organization uses to reach results, such dispute may lead to inefficiency, despite the investment and effort spent. The perceptions of possible conflicts involving IT area and its internal customers of two Brazilian telecommunications companies are contradictory or coincidental, according to the vision of each of the area? What are the possible causes of conflict identified in each company?

Coreografias de serviços Web representam uma forma mais escalável e flexível de compor serviços do que uma abordagem centralizada como a orquestração, e seu papel na integração e comunicação de sistemas de larga escala é vital para os objetivos da SOC (Computação Orientada a Serviços) e da Internet do Futuro. Atualmente coreografias de serviços Web possuem vários desafios de pesquisa, dos quais a qualidade de serviço (QoS) e o monitoramento de coreografias de serviçosWeb são linhas importantes. O objetivo deste trabalho é propor e implementar um mecanismo de monitoramento não intrusivo de coreografias de serviços Web baseado em SLAs (Acordos de Nível de Serviço) que especificam as restrições de atributos de QoS de maneira probabilística. Esta dissertação propõe um mecanismo para coreografias de serviços Web que: (1) define requisitos de QoS; (2) especifica contratos probabilísticos sobre parâmetros de QoS usando SLA; e (3) realiza um monitoramento não intrusivo de coreografias de serviços Web para detectar violações de SLA. / Web services choreographies are a more scalable and flexible way to compose services than a centralized approach like orchestrations, and its role in the integration and communication of large-scale systems is vital for the goals of SoC (Service Oriented Computing) and Future Internet. Currently,Web services choreographies have several research challenges. From all challenges, quality of service (QoS) and monitoring of Web services choreography are important research lines. The goal of this work is to propose and implement a mechanism for non-intrusive monitoring of Web services choreography based on SLAs (Service Level Agreements) that define constraints of QoS attributes in a probabilistic way. This thesis proposes a mechanism for Web services choreographies that:(1) defines QoS requirements; (2) specifies probabilistic contracts on QoS parameters using SLAs; and (3) monitors, non-intrusively, the enactment of Web services choreographies to detect SLA violations.