Distributed network security is an important concern in modern business environments. Access to critical information and areas has to be limited to authorised users. The Herold research project aims to provide a novel way of managing distributed network security through the means of agent-based software. In this paper we present the first models, both conceptual and technical that have been produced in this project. Furthermore we examine the Paose development approach used within the project and how it contributes to Herold.

Given that faults cannot be prevented in sufficiently complex systems, means of fault tolerance are essential for dependable distributed systems. Designing and evaluating fault-tolerant systems require well-conceived fault models. In the past, theoretical works have used simplified models that, while being tractable, turned out to be inaccurate. Practical works have used probabilistic fault models that, while being more accurate, often turned out to be intractable. Timo Warns bridges the gap between theory and practice regarding fault models. He has developed tractable fault models that, while being non-probabilistic, are accurate for dependent and propagating faults. Using seminal problems such as consensus and constructing coteries, he demonstrates how the new models can be used to design and evaluate effective and efficient means of fault tolerance.

Quorums are flexible and well-studied means for implementing fault-tolerant distributed systems. The probe complexity gives the number of probes required to find a quorum of noncrashed processes or to reveal that no such quorum currently exists. In this paper, we refine the original notion of probe complexity by explicitly considering the underlying failure model. A refined probe complexity gives a tight bound on the number of required probes, which is lower than the original probe complexity for most failure models. Additionally, we present a universal probe strategy that is defined for all quorum sets and exhibits the refined probe complexity in the worst case. In contrast, previous probe strategies were limited to special quorum sets, namely to coteries, and meet the original probe complexity only for special (i. e., nondominated) coteries.

Modern distributed systems are highly dynamic in nature with processes arriving and departing deliberately. Traditional strict quorum-based data replication schemes are either static or limited in their dynamics by a fixed, a priori defined upper bound on the number of processes manageable at run-time. Moreover, they are homogeneous meaning that a single scheme-inherent strategy for building quorum systems is used at every stage of the dynamics. In this paper, we present a novel unifying method for the specification of heterogeneous dynamic strict quorum-based data replication schemes which includes homogeneous schemes as a special case. The method allows to adapt to an unbounded number of processes at run-time and provides new means to flexibly trade-off important quality measures like, e.g., operation availability and costs by beneficially exploiting heterogeneity.

Dependability models of distributed systems are often parameterised by the failure characteristics of the nodes that form a system. For realistic results, these parameters must be estimated accurately, for example, based on evaluations of real-world systems. We empirically evaluate over 400 globally distributed nodes of the PlanetLab research cluster and estimate the popular parameters mean-time-to-failure, mean-time-to-repair, availability, and failure correlation coefficients. We fit the resulting empirical distributions by simple theoretical distributions and find that the mean-time-to-failure, the availability, and the failure correlation coefficient correlate with the geographical distance between nodes.

Quorum systems are widely used means to realize agreement and coordination in fault-tolerant distributed systems. Highly available quorum systems are optimal with respect to resilience as they provide quorums with a sufficient number of correct processes despite any assumed fault scenario. Structural failure models describe all assumed fault scenarios by sets of faulty processes, which abstracts from detailed stochastic assumptions and covers both independent and dependent failures. In this paper, we give necessary and sufficient conditions for the existence of highly available quorum systems in terms of structural failure models. These results generalize previous work as we cover both, static and dynamic quorum systems, dependent failures, and consider crash as well as Byzantine failures.

Failure models characterise the expected component failures in fault-tolerant computing. In the context of distributed systems, a failure model usually consists of two parts: a functional part specifying in what way individual processing entities may fail and a structural part specifying the potential scope of failures within the system. Such models must be expressive enough to cover all relevant practical situations, but must also be simple enough to allow uncomplicated reasoning about fault-tolerant algorithms. Usually, an increase in expressiveness complicates formal reasoning, but enables more accurate models that allow to improve the assumption coverage and resilience of solutions.In this paper, we introduce the structural failure model class DiDep that allows to specify directed dependent failures, which, for example, occur in the area of intrusion tolerance and security. DiDep is a generalisation of previous classes for undirected dependent failures, namely the general adversary structures, the fail-prone systems, and the core and survivor sets, which we show to be equivalent. We show that the increase in expressiveness of DiDep does not significantly penalise the simplicity of corresponding models by giving an algorithm that transforms any Consensus algorithm for undirected dependent failures into a Consensus algorithm for a DiDep model. We characterise the improved resilience obtained with DiDep and show that certain models even allow to circumvent the famous FLP impossibility result.

An important concern for the successful deployment of a dependable system is its quality of service (QoS), which is significantly influenced by its architectural style. We propose the comparative evaluation of architectural styles by simulation. Our approach integrates architectural styles and concrete architectures to enable early design-space exploration in order to predict the QoS of peer-to-peer systems. We illustrate the approach via two case studies where availability of resources and performance of peer-to-peer search methods are evaluated. Based on our experience with these simulation environments, we sketch tool support for simulating architectural changes at runtime.

Basic concepts and terminology for trustworthy software systems are discussed. Our discussion of definitions for terms in the domain of trustworthy software systems is based on former achievements in dependable, trustworthy and survivable systems. We base our discussion on the established literature and on approved standards. These concepts are discussed in the context of our graduate school TrustSoft on trustworthy software systems. In TrustSoft, we consider trustworthiness of software systems as determined by correctness, safety, quality of service (performance, reliability, availability), security, and privacy. Particular means to achieve trustworthiness of component-based software systems - as investigated in TrustSoft - are formal verification, quality prediction and certification; complemented by fault diagnosis and fault tolerance for increased robustness.

Self-stabilizing systems are often only evaluated in terms of worst-case time and space complexities for the recovery from arbitrary state disruptions. In this paper, we interpret and formalize well-known fault tolerance measures for masking fault-tolerant systems, namely reliabilty, instantaneous availability, and limiting availability in the context of self-stabilizing systems. This allows to additionally evaluate selfstabilizing systems by these well-accepted measures. The calculation is challenging due to a large (and possibly infinite) state space. We present an analysis procedure that comprises a suitable state abstraction thereby making the calculation tractable. Exemplarily, we apply the procedure to a system that constructs a depth-first search spanning tree showing that our approach is feasible and yields meaningful results.

Instrumentation of software is a part of debugging, performance evaluation and autonomic software systems. It enables the observability of program behaviour. However, instrumentation is costly and error prone. This paper presents an approach called Model Driven Instrumentation for Relational Event Traces. The approach enables the specification of system models and models for instrumentation as separate concerns, and allows to automatically generate instrumented systems from the models.

An increasing number of digital library management systems is developed following P2P architectures to overcome the bottlenecks of client/server architectures. Usually, the participating peers are less dependable than traditional servers. Hence, a P2P system needs to deal with failures of single peers to avoid overall system failures. Replication is a means to improve availability of resources.We empirically investigate the influence of replication techniques on availability by simulations. We focus on voting-based replication control strategies which offer one-copyserializability in the context of our XPeer architecture.

Der Aspekt der Vertrauenswürdigkeit nimmt eine zunehmend größere Rolle bei der Entwicklung von Software ein. Um die dabei auftretenden Herausforderungen zu bewältigen, ist die Zusammenarbeit der Communities der Fehlertoleranz, Sicherheit und Softwaretechnik gefragt. Dieser Bericht fasst die Ergebnisse der ICSE Workshops Software Engineering for Secure Systems (SESS) und Workshop on Architecting Dependable Systems (WADS) 2005 zusammen, in denen diese Communities zusammentrafen.

AbstractThis paper addresses the issue of quantitatively investigating availability within peer-to-peer systems. We devise a conceptual framework integrating architectural styles, architectures, and concrete systems. We identify basic characteristics of architectural styles for peer-to-peer systems and give a formal model to describe derived architectures. Architectural descriptions are used as input for simulations to predict the availability of services within real-world systems.

Intrusion tolerance is a recent approach to deal with intentional and malicious failures. It combines the research on fault tolerance with the research on security, and relies on the means of proactive security. The development of a fault-tolerant system requires the explication of its underlying fault assumptions. In this context, we propose a viewpoint on faults that discriminates whether they are timely exploitable and, therefore, are not covered by proactive security.

Im Bereich der Software-Entwicklung findet ein Wechsel von der rein objekt-orientierten hin zur komponentenbasierten Entwicklung statt [4]. Voraussetzung fur eine grose Verbreitung dieser Methoden und Techniken sind Komponentenarchive [6]. Diese sollen Software-Entwickler unterstutzen, selbst entwickelte Komponenten anzubieten und geeignete bereits bestehende Komponenten fur eigene Systeme zu finden. Nur mit Hilfe von strukturierten Archiven kann eine Wiederverwendung von Komponenten ermoglicht werden. In einer Lehrveranstaltung in Form einer Projektgruppe wurde an der Carl-von-Ossietzky Universitat Oldenburg ein Marktplatz fur und mit Enterprise Java Beans entwickelt. Projektgruppen sind Veranstaltungen im Umfang von 8 SWS im Hauptstudium der Informatikausbildung an der Universitat Oldenburg, in denen bis zu zwolf Studierende im Zeitraum von zwei Semestern gemeinsam ein groseres Projekt bearbeiten. Dies fand im Sommersemester 2002 und Wintersemester 2002 / 2003 in der Abteilung Software-Engineering unter der Leitung von Prof. Dr. Wilhelm Hasselbring statt. Vorgaben der Lehrveranstaltung waren, dass eine WebAnwendung gemas der J2EE-Architektur [5] implementiert wird, die sowohl im Internet als auch in firmeninternen Netzen eingesetzt werden kann. Dafur sollten eine Benutzerverwaltung und ein Ordnungssystem fur Komponenten entwickelt werden. Eingestellte Komponenten sollten formal spezifiziert werden konnen, um die Aufindbarkeit zu gewahrleisten. Ein Screenshot des Marktplatzes ist in Abbildung 1 zu sehen.