Provenance-based validation of e-science experiments

Policies are being increasingly used for controlling the behavior of complex multi-agent systems. The use of policies allows administrators to regulate agent behavior without changing source code or requiring the consent or cooperation of the agents being governed. However, policy-based control can sometimes encounter difficulties when applied to agents that act in pervasive environments characterized by frequent and unpredictable changes. In such cases, we cannot always specify policies a priori to handle any operative run time situation, but instead require continuous adjustments to allow agents to behave in a contextually appropriate manner. To address these issues, some policy approaches for governing agents in pervasive environments specify policies in a way that is both context-based and semantically-rich. Two approaches have been used in recent research: an ontology-based approach that relies heavily on the expressive features of Description Logic (DL) languages, and a rule-based approach that encodes policies as Logic Programming (LP) rules. The aim of this paper is to analyze the emerging directions for the specification of semantically-rich context-based policies, highlighting their advantages and drawbacks. Based on our analysis we describe a hybrid approach that exploits the expressive capabilities of both DL and LP approaches.

/pdf/rule-based-and-ontology-based-policies-toward-a-hybrid-2debqnkza3.pdf

Rule-based and Ontology-based Policies: Toward a Hybrid Approach to Control Agents in Pervasive Environments

E-Science experiments typically involve many distributed services maintained by different organisations. After an experiment has been executed, it is useful for a scientist to verify that the execution was performed correctly or is compatible with some existing experimental criteria or standards. Scientists may also want to review and verify experiments performed by their colleagues. There are no exsiting frameworks for validating such experiments in today's e-Science systems. Users therefore have to rely on error checking performed by the services, or adopt other ad hoc methods. This paper introduces a platform-independent framework for validating workflow executions. The validation relies on reasoning over the documented provenance of experiment results and semantic descriptions of services advertised in a registry. This validation process ensures experiments are performed correctly, and thus results generated are meaningful. The framework is tested in a bioinformatics application that performs protein compressibility analysis.

https://link.springer.com/content/pdf/10.1007%2F11574620_57.pdf

Security requirements deal with the protection of assets against unauthorized access (disclosure or modification) and their availability to authorized users. Temporal constraints of history-based access control policies are difficult to express naturally in traditional policy languages. We propose a compositional formal framework for the specification and verification of temporal access control policies for security critical systems in which history-based policies and other temporal constraints can be expressed. In particular, our framework allows for the specification of policies that can change dynamically in response to time or events enabling dynamic reconfiguration of the access control mechanisms. The framework utilizes a single well-defined formalism, interval temporal logic, for defining the semantics of these policies and to reason about them. We illustrate our approach with a detailed case study of an electronic paper submission system showing the compositional verification of their safety, liveness and information flow properties.

/pdf/dynamic-access-control-policies-498hnccztf.pdf

Dynamic Access Control Policies

Logic-based policy languages are appreciated because of their clean semantics and expressiveness. Datalog has been used for a long time as a foundation of many security models and policy languages. Recently, Description Logics (DLs for short) have been adopted as policy languages, too. In this paper we carry out a comparison of Datalog and Description Logics as policy languages, based both on expressiveness analysis and on an assessment of the current maturity of the two fields, expressly related to the representation and reasoning tasks involved in policy authoring, enforcement, and management. We shall argue that Datalog-based approaches are currently more powerful and mature than those based on pure DLs, although the ongoing research on the latter might change the picture in a near future. The potential of hybrid approaches will be briefly discussed.

Datalog for security, privacy and trust

Complex services in service-oriented architectures such as the grid typically require to be configured in multiple ways that cannot be anticipated by service designers; we illustrate this requirement by studying the myGrid registry, a grid registry capable of supporting annotations of service descriptions by third-party users. Instead, services have to be conceived so that they can be configured at deployment and run time. We argue that KAoS is a powerful and flexible language that can help define such configurations. Using our registry case study, we examine the requirements that the definition of such complex configurations brings on policy languages and explain how they can be satisfied. Specifically, we use role-value maps to express constraints between property values; we introduce a notion of PolicySet with associated parameters that support constraints within a well defined scope; finally, we define a notion of context that allows us to refer to property values that were extant in past execution environments. Essentially, these concepts allow us to add constraints to values in policy definitions, to organise policies in coherent and structure blocks, and to refer to the execution history. The paper discusses these concepts and how they are implemented in a binding of the KAoS policy language to the myGrid registry.

/pdf/behavioural-specification-of-grid-services-with-the-kaos-pu7yhsr8xz.pdf

Behavioural specification of grid services with the KAoS policy language

Enabling civil-military collaboration for disaster relief operations in smart city environments

Policies are being increasingly used for controlling the behavior of complex systems (including agent systems). The use of policies allows administrators to specify agent permissions and obligations without changing source code or requiring the consent or cooperation of the entities being governed. Past approaches to policy representation have been restrictive in many ways. By way of contrast, semantically-rich policy representations can reduce human error, simplify policy analysis, reduce policy conflicts, and facilitate interoperability. However, semantically-rich policies increase the complexity of fielding policy-governed multi-agent systems. This paper discusses some technical challenges to automatically enforce semantically-rich security policies in Java-based multi-agent systems and presents an engineering approach for addressing some of these challenges. We have developed a first implementation that allows to enforce OWL policies represented using the KAoS policy framework into multi-agent systems built on top of the JDK1.4. The proposed solution allows to control the behavior of agents at a high level of abstraction and exploits the security mechanisms provided by the Java authentication and authorization service (JAAS) to enforce OWL policies.

/pdf/automated-generation-of-enforcement-mechanisms-for-23dr9x853d.pdf

Automated generation of enforcement mechanisms for semantically-rich security policies in Java-based multi-agent systems

Abstract Multi-access edge computing (MEC) is a key enabler to fulfill the promises of a new generation of immersive and low-latency services in 5G and Beyond networks. MEC represents a defining function of 5G, offering significant computational power at a reduced latency, allowing to augment the capabilities of user equipments while preserving their battery life. However, the demands generated by a plethora of innovative and concurrent IT services requiring high quality of service and quality of experience levels will likely overwhelm the—albeit considerable—resources available in 5G and Beyond scenarios. To take full advantage of its potential, MEC needs to be paired with innovative resource management solutions capable of effectively addressing the highly dynamic aspects of the scenario and of properly considering the heterogeneous and ever-changing nature of next generation IT services, prioritizing the assignment of resources in a highly dynamic and contextual fashion. This calls for the adoption of Artificial Intelligence based tools, implementing self-* approaches capable of learning the best resource management strategy to adapt to the ever changing conditions. In this paper, we present MECForge, a novel solution based on deep reinforcement learning that considers the maximization of total value-of-information delivered to end-user as a coherent and comprehensive resource management criterion. The experimental evaluation we conducted in a simulated but realistic environment shows how the Deep Q-Network based algorithm implemented by MECForge is capable of learning effective autonomous resource management policies that allocate service components to maximize the overall value delivered to the end-users. 

/pdf/value-is-king-the-mecforge-deep-reinforcement-learning-2ynkakxu.pdf

Value is King: The MECForge Deep Reinforcement Learning Solution for Resource Management in 5G and Beyond

To Forward or not to Forward: Considerations on and Experiments with Network Layer Forwarding in Combination with Middleware Services for Group Communications

N. Suri

Papers

Behavioural specification of grid services with the KAoS policy language

Enabling civil-military collaboration for disaster relief operations in smart city environments

Automated generation of enforcement mechanisms for semantically-rich security policies in Java-based multi-agent systems

Value is King: The MECForge Deep Reinforcement Learning Solution for Resource Management in 5G and Beyond

To Forward or not to Forward: Considerations on and Experiments with Network Layer Forwarding in Combination with Middleware Services for Group Communications