Msadek, Nizar

English

OPUS Augsburg

Improving the Self-X Properties of OrganicComputing Systems with TrustNizar MsadekDepartment of Computer ScienceUniversity of AugsburgD-86159 Augsburg, GermanyEmail: Nizar.Msadek@informatik.uni-augsburg.deI. INTRODUCTIONThe Organic Computing Initiative [1] has turned out to be achallenging vision for future information processing systems.This initiative consists of developing computer systems capa-ble of so-called self-x properties (like self-configuration, self-optimization, self-healing and self-protection) to cope withthe rapidly growing complexity of computing systems and toreduce the barriers that complexity poses to further growth.These properties are achieved by constantly observing them-selves and initiating autonomous reconfiguration if necessary.An essential aspect that becomes particulary prominentin this kind of systems is trust [2]. As part of my PhDthesis, a new design of self-x properties for organic computingsystems will be investigated. Its main task is to improveself-x properties with trust capabilities to enable building areliable system from unreliable components. The middlewaresystem used in this work is the Trust-Enabling Middleware(TEM [3]) but these techniques can also be applied to anykind of distributed system.This dissertation is part of the research unit OC-Trust ofthe German Research Foundation(DFG), which presented thefollowing trust metrics to calculate the trust values required forthe self-x properties. It is to note that all these trust metricsare integrated in TEM.• Direct Trust [4] Is based on the experiences one hasmade directly with an interaction partner. Typically, trustvalues are calculated by taking the mean or weightedmean of past experiences.• Reputation [5] Is based on the trust values of others thathad experiences with the interaction partner. Reputationis typically raised if not enough or outdated experiencesexist.• Confidence [6] Before both values, direct trust andreputation, can be aggregated to a total trust value, thereliability of one’s own trust value has to be determined,the so called confidence. If a node does have a direct trustvalue but is not confident about its accuracy, it needs toinclude reputation data as well.• Aggregation [7] When all the aforementioned values areobtained, a total trust value based on the direct trust andreputation values can be calculated using confidence toweight both parts against each other. This value can thenbe used to improve the self-x properties.The remainder of this paper is structured as follows.Section II introduces self-configuration, Section III gives anoverview of self-optimization, Section IV describes mecha-nisms of self-healing and how to cope with failures. Section Vpresents the role of self-protection. Conflicting problems oftrust values are discussed in Section VI. Finally, the scalabilityis shown in Section VII.II. SELF-CONFIGURATIONThe approach of self-configuration is a crucial part fordeveloping dependable and robust systems using self-x prop-erties. This consists mainly of finding a robust distributionof services by including trust. The services are thereforecategorized into important services i.e., with high trust level,and non important services i.e., with low trust level. Thegoal is to maximize the availability of important services.Therefore, it is necessary to assign the more important servicesto more reliable nodes. In addition to the reliability, resourcerequirements (e.g., like CPU and memory) should also beconsidered to be able to balance load of the nodes.A. MetricsThe self-configuration focuses on assigning services withdifferent trust levels to nodes such that the more importantservices are assigned to the more reliable nodes. Furthermore,the overall utilization of resources in the network should bewell balanced. Therefore a metric is defined to calculate aQuality of Service (QoStotal).QoStotal = (1− α) ·QoStrust + α ·QoSworkload.The relationship between trust and workload can be setthrough α. α is constant (0 ≤ α ≤ 1) for a node. If α = 1, theQoStotal is only obtained by the current value QoSworkload.If α = 0, the QoStotal is decided only by the actual QoStrustvalue. A higher value α favors QoSworkload over QoStrust.• QoStrust indicates how well the reliability of a nodefulfilled the required reliability of a service. Figure 1visualizes the possible situations that can occur in thecalculation of the QoStrust.45𝑡𝑛  𝑡𝑛 +  δ𝑚𝑎𝑥  𝑡𝑛 + δ𝑚𝑖𝑛  𝑡𝑛 −  δ𝑚𝑎𝑥  +Φ  -Φ 𝑄𝑜𝑆𝑡𝑟𝑢𝑠𝑡  𝑇𝑟𝑢𝑠𝑡  𝑡𝑛 −  δ𝑚𝑖𝑛  0 𝑡𝑠   1 𝑡𝑛  : Current trust value (i.e., reliability) of a node.   𝑡𝑠  : Required trust value (i.e., reliability) of a service. Fig. 1. Calculating QoStrust based on the difference between the reliabilityof the node n (tn) compared to the required reliability of the service s (ts)tn represents the current trust value of a node n. tsrepresents the required trust value of service s. If bothof these values are close enough then n has fulfilledthe required trust value of a service s. Close enough isdefined by the threshold δmin. If the difference betweentn and ts is more than δmin, then QoStrust will begradually decreased until it reaches tn ± δmax. If ts iseven beyond tn ± δmax then the QoStotal will be fullydecreased by φ where φ is the maximum value QoStrustcan decrease.• QoSworkload is computed with the metric of Trum-ler [8]. As long as a node is not overburdened, the qualityof service decreases linearly, otherwise it decreases ex-ponentially.B. Self-Configuration ProcessThis section discusses the methodology for distributingservices. This consists of a collection of services with differentpriority levels which should run on nodes with differentreliability levels. It is known to be a NP-hard problem tofind an optimal solution for the distribution of the serviceson the nodes, such that the quality of service is optimalin terms of some predefined parameters [9]. Furthermore,there is no known polynomial algorithm which can, for agiven solution, identify whether it is optimal. The aim behindself-configuration is to find a distributed and robust but notnecessarly optimal, solution.The quality of service metric presented in II-A is intended toevaluate the distribution phase which is based on the ContractNet Protocol [10]. During the distribution phase, every nodeon the network can act at different times or for differentservices as a manager or contractor. A manager is responsiblefor assigning services. A contractor is responsible for actualexecution of the service. However, the manager is determinedearlier by the user. Figure 2 visualizes a step-by-step exampleon how the negotiation process is run between nodes.1) Service Announcement: The manager (e.g., node1) thathas a service initiates contract negotiation by advertisingthe existence of that service to the other contractors (e.g.,node2, node3 and node4) with a service announcement(1) Announcement(1) Announcement(1) Announcement(2) Bidding(2) Bidding(3) Awarding(2) Biddingnode1(Manager)node2(Contractor)node4(Contractor)node3(Contractor)Fig. 2. Elementary representation of the distribution phasemessage. A service announcement can be transmittedto a single contractor in the network (unicast), to aspecific set of contractors (multicast) or to all contractors(broadcast).2) Bidding: Every contractor that receives the announce-ment calculates the QoSworkload itself for the givenservice, i.e., based on its own locally available resourcesand then submit its bid in form of QoSworkload to themanager back. Note that the service annoucement isignored if the service cannot be hosted due to missingresources.3) Awarding: If the expiration time has passed, the man-ager that sends the service announcement must calculateQoStrust for every contractor in order to build theQoStotal and decides who to award the contract to. Theresult of this process will be then communicated to thecontractors that submitted a bid. The expiration time isdefined as a deadline for receiving bids. It is to note thatthe expiration time is determined earlier by the user.C. Conflict ResolutionDuring the self-configuration process, several nodes couldbe ranked with the same QoStotal. This might lead to a conflictfor the manager to decide to whom he awards the service.To avoid this a conflict resolution mechanism is used whichdoes not need any further messages. The conflict resolutionmechanism consists of three stages which might be used inthe following chronological order:1) Minimum latency: The node with the lowest latencywill get the service.2) Minimum amount of already assigned services: Thenode with the least amount of already assigned serviceswill get the service, assuming that a lower amount of46services will produce less load (e.g., process or threadswitching produces additional load).3) Node ID: It is unlikely but not impossible that all of theformer values were equal. In this case the id of the nodewill be used to find a solution to the conflict becauseevery node has a unique id.III. SELF-OPTIMIZATIONBased on the proposed self-configuration techniques, theservices can be distributed on the nodes by different distri-bution strategies:• Uniform distribution: The services are distributed onthe nodes to evenly utilize all nodes and prevent singlenodes to be overburdened. This leaves every node with asafety margin to cover possible performance spikes.• Power save distribution: All services should run ona minimal number of nodes, so that free nodes can bedeactivated in order to save energy.Without trust, important services might run on unreliablenodes and are prone to failures. Such situations can be avoided.With trust, the reliability of a node can be measured and takeninto consideration for the service distribution. For that reason,the distribution mechanisms should be investigated with andwithout a known reliability. The differences between usingtrust and not using trust have to be evaluated regarding thedowntime of important services.IV. SELF-HEALINGTo investigate and research Self-Healing metrics, two wayshave to be considered:• Proactive Self-Healing: Enables to detect node instabil-ity prior to fail and then to move all running servicesby using self-configuration techniques to a more reliablenode. False proactive shifts should be avoided.• Reactive Self-Healing: Nodes save recovery informationperiodically during failure free execution. Upon failure,which has to be detected by using a failure detector, anode uses the already saved information to restart froman intermediate state i.e., called checkpoint, thus reducingthe amount of lost computation.V. SELF-PROTECTIONTrust values build the basis for all operations to increasethe robustness of an organic computing system. Therefore,they must be specially protected against manipulation. Mármoland Pérez [11] presented some of the most important andcritical security threat scenarios that can be found in the areaof trust and reputation in a distributed system. Hence, all thesescenarios have to be investigated and researched in order tomake the self-x properties more resistent against such attacks.VI. PROBLEM OF CONFLICTING TRUST VALUESAnother interesting point is to find a solution for conflictingtrust values. This can happen by collecting reliability valuesindependently from the neighbors of a node that can contradictnode1node2 node3t12 = 1t13 = 1t31 = 1t32 = 0.2t21 = 1t23 = 0.2Fig. 3. Trust conflicting values in an example of three nodeseach other. Figure 3 visualizes this problem in an example ofthree nodes.A shielding wall is set between two nodes i.e., node2 andnode3 producing poor reliability values between these nodes,while a third node (node1) is not affected. t23 is the trustvalue node2 has about node3, so it wants to apply self-healingtechniques in order to save all services running on node3,while node1 sees no need for action. Such situations must beomitted using metrics, which enable to deal with conflictingvalues.VII. DEALING WITH LARGE SCALE ORGANIC COMPUTINGSYSTEMSIn a hierarchical system, e.g., in a clustered Data Center,the already developed trust metrics are so far not entirelyapplicable, since only the next level in the hierachy is visible.Some nodes within a cluster could be less trustworthy. Thecluster itself is still trusted because the cluster head is ableto deal with its cluster members. Such situations can beomitted by using methods enabling the cluster head to controlunreliable cluster members and to return a good result despitesuch members.VIII. RELATED WORKThe presented trust-enhanced self-x properties differ fromstate of the art selforganising mechanisms [12] [13] [1] [14]in three major points:1) Development of techniques that allow the considerationof trust during analysis and interaction of Organic Com-puting systems.2) Possibility to control complex systems with variablebehavior.3) Making a reliable and robust system out of unreliablecomponents.IX. SUMMARY AND OUTLOOKIn this paper, a new design of self-x properties for organiccomputing systems is presented. Its main task is to improveusing trust self-configuration, self-optimization, self-healingand self-protection. This approch will be embedded in a futurework into the TEM, which is a trust enabling middlewareimplemented in Java and based on a peer to peer network.47Furthermore, two major existing problems in TEM are dis-cussed, which are scalability and conflicting trust values.ACKNOWLEDGMENTThis research is sponsored by the research unit OCTrust(FOR 1085) of the German Research Foundation (DFG).REFERENCES[1] C. Müller-Schloer, “Organic Computing - On the Feasibility of Con-trolled Emergence,” CODES + ISSS 2004. International Conferenceon Hardware/Software Codesign and System Synthesis, 2004., vol. 2-5, 2004.[2] J.-P. Steghöfer, R. Kiefhaber, K. Leichtenstern, Y. Bernard, L. Kle-jnowski, W. Reif, T. Ungerer, E. André, J. Hähner, and C. Müller-Schloer, “Trustworthy Organic Computing Systems: Challenges andPerspectives ,” Proceedings of the 7th International Conference onAutonomic and Trusted Computing (ATC 2010), Springer, vol. 14, pp.62–76, 2010.[3] G. Anders, F. Siefert, N. Msadek, R. Kiefhaber, O. Kosak, W. Reif, andT. Ungerer, “TEMAS - A Trust-Enabling Multi-Agent System for OpenEnvironments,” Universität Augsburg, Tech. Rep., 2013.[4] R. Kiefhaber, B. Satzger, J. Schmitt, M. Roth, and T. Ungerer, “Trustmeasurement methods in organic computing systems by direct obser-vation,” in IEEE/IFIP 8th International Conference on Embedded andUbiquitous Computing (EUC 2010), december 2010, pp. 105 –111.[5] R. Kiefhaber, S. Hammer, B. Savs, J. Schmitt, M. Roth, F. Kluge,E. André, and T. Ungerer, “The neighbor-trust metric to measurereputation in organic computing systems,” in Fifth IEEE Conference onSelf-Adaptive and Self-Organizing Systems Workshops (SASOW 2011),october 2011, pp. 41 – 46.[6] K. Rolf, A. Gerrit, S. Florian, U. Theo, and R. Wolfgang, “Confidenceas a means to assess the accuracy of trust values,” in The sixth IEEEInternational Conference on Self-Adaptive and Self-Organizing Systems(SASO2012), september 2012.[7] K. Rolf, J. Ralf, M. Nizar, and U. Theo, “Ranking of direct trust, confi-dence, and reputation in an abstract system with unreliable components,”in The seventh IEEE International Conference on Self-Adaptive and Self-Organizing Systems (SASO2013), september 2013.[8] W. Trumler, “Organic ubiquitous middleware,” Ph.D. dissertation, 2006.[9] K. R. Reischuk, Komplexitätstheorie: Band 1. Teubner Verlag, 1999.[10] R. G. Smith, “The Contract Net Protocol: High-Level Communicationand Control in a Distributed Problem Solver ,” in Defence ResearchEstablishment Atlantic. IEEE TRANSACTIONS ON COMPUTERS,,1980, pp. 1–10.[11] F. G. Mármol and G. M. Pérez, “Security threats scenarios in trustand reputation models for distributed systems,” Computers & Security,vol. 28, no. 7, pp. 545–556, 2009.[12] R. Urban, M. Moez, B. Jürgen, M.-S. Christian, and S. Hartmut, “To-wards a generic observer/controller architecture for organic computing,”Bonner Köllen Verlag, pp. 112–119, 2006.[13] O. Jeffrey and C. David M, “The vision of autonomic computing,” IEEEComputer Society, pp. 41 – 50, 2003.[14] B. Jürgen, M. Moez, M.-S. Christian, P. Holger, R. Urban, R. Fabian, andS. Hartmut, “Organic computing addressing complexity by controlledself-organization,” Second International Symposium on Leveraging Ap-plications of Formal Methods, Verification and Validation, pp. 185 –191, 2006.48

Improving the self-X properties of organic computing systems with trust

https://opus.bibliothek.uni-augsburg.de/opus4/files/106141/106141.pdf

Improving the self-X properties of organic computing systems with trust

Abstract

Similar works

Full text

Available Versions

OPUS Augsburg