Embed Size (px)
Citation preview
© Fraunhofer IESE
Future @ Cloud: Cloud Computing meets Smart EcosystemsJoerg Doerr, Fraunhofer IESE, Kaiserslautern, Germany
© Fraunhofer IESE
2
Fraunhofer-Institute for Experimental Software Engineering (IESE)
Leading Institute for Software Engineering
Founded in 1996 in Kaiserslautern, Germany
200 employees
Focus on software engineering
Provide innovative and value-adding customer solutions with measurable effects
Advance the state-of-the art in software and system engineering
Promote the importance of empirically based software and system engineering
www.iese.fraunhofer.de
© Fraunhofer IESE
3
Fraunhofer IESE – Our Competencies
SOFTWARE-ENABLED INNOVATIONS
forinnovative
Systems
© Fraunhofer IESE
4
Fraunhofer IESE – Our Competencies
SOFTWARE-ENABLED INNOVATIONS
© Fraunhofer IESE
5
Digital Society Business Life: Integration Enables Innovation!
… in Information Systems as well as in Embedded Systems
© Fraunhofer IESE
6
New business models
that did not work in the past start to work now (Apple Store, Micropayment, ..)
Private life pushes business life
Physical objects go digital
Machinery, things, living objects like plants and animals
Usage of Big Data to exploit available data
Uncertainty at runtime
Trends and Implications
© Fraunhofer IESE
7
IT Mega Trend: Integration
Big Data / Data Analytics
© Fraunhofer IESE
8
Digital Ecosystems
Software Ecosystems deliver innovations through integrated software systems
are typically driven by multiple organizations at their own pace to interact with shared markets
operate through the exchange of data, functions, or services with mutually influencing parts
Smart Ecosystems integrate non-trivial information systems supporting business goals
integrate non-trivial embedded systems supporting technical goals
function as one unit to achieve a common, superior goal and share context-dependent information
© Fraunhofer IESE
9
Integration of IS and ES - Differences
Key Goals Optimization of Business Processes
Optimization of Technical Processes (sensors and actuators)
Optimization of both,Business Processes & Technical Processeswith Equal Rights
Software Engineering
IS-Driven(Information Systems 2.0)
may include embedded data in workflows
ES-Driven(Embedded Systems 2.0)
may use information systems for data storage, e.g., in the cloud
ES/IS-Integration
Participative Engineering: Across Organizations (sometimes with Equal Rights)
Key Qualities(Examples)
Security Safety Safety & Security
© Fraunhofer IESE
10
Smart EcosystemsA Trend Across Domains
Smart Ecosystems
Industry 4.0
V2X and C2X
eEnergy
…
eHealth
Smart Farming
© Fraunhofer IESE
11
Research in Smart EcosystemsKey Challenges Diversity
Uncertainty
Complexity
Guaranteed Qualities
e.g., Safety and
Security
Lifecycle Management
Big Data
© Fraunhofer IESE
12
Big Data Analysis in Smart Ecosystems
Organization 1
Runtime environment
Data sourcesn
Algorithmics+analyses
Visualization
Modeling
Data Miner & Generator
Organization N
Runtime environment
Data sources
Algorithmics+analyses
Visualization
Modeling
Data Miner & Generator
Virtual runtime environment
Global analyses, algorithmics, data fusion, analysis data base
Visualization
Ecosystem SimulatorCrowd Data Miner Data generation
Standardized modeling for analyses and released data
Usage control
Usage control…
© Fraunhofer IESE
13
Dealing with Data in Smart Ecosystems– Cloud asPotential Boost for Analytics & Interoperation – Data Usage Control as Key Business Enabler
Moving Data to the Cloud = Moving Data to Third Parties
Data Protection Challenges
Data Residency (data must be kept within defined geographic borders)
Data Privacy (enterprise is responsible for any breach to data)
Compliance (enterprise must comply with applicable laws)
Data Usage Control (data is accessed from different entities)
Main concerns for critical infrastructure IT using the Cloud
Security and Privacy
https://seccrit.eu/upload/CloudCritITSurvey.pdf, 10-03-2014, SECCRIT
© Fraunhofer IESE
14
MotivationSECCRIT in a Nutshell
Challenges
Analyse and evaluate cloud computing with respect to security risks in sensitiveenvironments (i.e., critical infrastructures)
Goal
Development of methodologies, technologies, best practices for secure, trustworthy, high assurance and legal compliant cloud computingenvironments for critical infrastructure IT.
Enable cloud technologies to be used for critical infrastructure IT
© Fraunhofer IESE
15
SECCRITResearch Focus at Fraunhofer IESE
Multi-layer Policy Decision and Enforcement for Usage Control Policies
Policy enforcement on different abstraction layers of the cloud(e.g., cloud infrastructure or service level)
Context-aware policy enforcement mechanisms(e.g., respecting geolocation if data or service is migrated)
User-friendly Policy Specification
Elicitation method for security demands and mapping to machine-enforceable security policies
Reduction of errors and misunderstandings in policy specification
© Fraunhofer IESE
16
Policy Decision and EnforcementFramework: IND²UCE
Dynamic framework for policy decision and enforcement
Seamless integration of new components
Dynamic management during runtime
Powerful policy language
© Fraunhofer IESE
17
Policy Decision and EnforcementSECCRIT Architectural Framework (Policy-oriented View)
PEP and PXP as enforcement components on different abstraction levels
PDP as central decision component
PIP component as additional information retrieval component for the decision making
PAP as interface between stakeholders and policy framework
© Fraunhofer IESE
18
Enforcement in the Cloud Infrastructure LevelScenario: Enforcing Anti-Affinity Policy
Scenario: Tenant A runs critical infrastructure services on different machines (VMs) on a virtual datacenter. However, the services are not allowed to share the same physical resources!
Problem: If Tenant A or the cloud infrastructure operator starts migrating virtual machines (VMs) to the same physical host, both critical services run on the same physical host.
VMware offers affinity rules, but allows their violation
Solution: An anti-affinity policy specifies that critical VMs have to be separated. Migrating critical VMs to the same physical host results in automatically migrating the other critical service away.
© Fraunhofer IESE
19
Enforcement in the Cloud Infrastructure LevelScenario: Enforcing Virtual Machines Geolocation
Scenario: A virtual machine hosts sensitive data and is only allowed to be operated in countries within Europe.
Problem: A cloud operator might trigger the process to migrate the virtual machine to another data center outside Europe.
Solution: A virtual machines geolocation policy specifies that virtual machines are only allowed to be operated in data centers within Europe. Migrating the virtual machine outside Europe will be logged and countermeasures enforced.
© Fraunhofer IESE
20
Enforcement in the Cloud Infrastructure LevelIND²UCE for VMware
VMware vSphere
VMware vSphere
VMware vCenter Server
Manage
SOAP
VMware vSphereClient
independent of VMware changes(except for interface changes)
no disturbance of other systems
only detective enforcement
© Fraunhofer IESE
21
Enforcement in the Service LevelIND²UCE for HBase/Hadoop Cloud Databases
HBase: NoSQL database inspired and modeled after Google‘s Bigtable1
Hadoop: Distributed File System(HDFSTM) + Hadoop MapReduce
Idea: Distribute big data into clusters
MapReduce algorithm
1 http://research.google.com/archive/bigtable.html
© Fraunhofer IESE
22
Enforcement in the Service LevelScenario: Modify Data in Transit
Scenario: A first level support worker is accessing person-related data for their customers. However, support worker should not have access to fields such as the concrete date of birth.
Problem: The database stores the date of birth in one field and can only return the entire field or nothing. The data usage restriction could only be solved by changing the database fields accordingly.
Solution: A privacy policy specifies to replace day of birth and month of birth with ‘X’. Only year of birth is visible to the first level support worker.
© Fraunhofer IESE
23
Enforcement in the Service LevelIND²UCE for HBase/Hadoop Cloud Databases
Name Node Secondary Name Node Data Node Data Node
Job Tracker
Task Tracker Task Tracker
Hadoop
HDFS
HMaster1
Region Server
Region Server
HMaster2
HBase
Map Reduce
Zookeeper1
Zookeeper2Zookeeper3
Zookeeper Ensemble
Control & Message Signals
One way dependency
Bi-directional dependency
© Fraunhofer IESE
24
Takeaways
Companies and Society can strongly benefit from Smart Ecosystems
Opportunity and threat at the same time for companies
Cloud Computing can be a significant boost for analytics and interoperability
Challenges in Smart Ecosystems require guaranteed qualities
Data Usage Control will be a business enabler, Security is not a showstopper
Fraunhofer IESE provides strong competences for Smart Ecosystem challenges
