A Risk-Evaluation Assisted System for Service Selection

Size: px

Start display at page:

Download "A Risk-Evaluation Assisted System for Service Selection"

Madeline Stanley
8 years ago
Views:

1 A Risk-Evaluation Assisted System for Service Selection Ennan Zhai and Liang Gu Yale University

2 Service Oriented Architecture Custom Built App Low-level Systems Developer COTS Packages External Services Service Bus Datasets Service1 Service2

3 Unexpected Risks Custom Built App Low-level Systems Developer COTS Packages External Services Service Bus Datasets Service1 Service2

4 Unexpected Risks Custom Built App Low-level Systems Developer COTS Packages External Services Service Bus Datasets Service1 Service2

5 Example Video App

6 Example Video App Crypt Lib S3 Azure

7 Example Video App Encoding Encoding Crypt Lib S3 Azure

8 Example Video App Query Query Encoding Encoding Crypt Lib S3 Azure

9 Example Video App Query Query Encoding Encoding Crypt Lib S3 Azure

10 Example Video App Query Query Encoding Encoding Crypt Lib S3 Azure

11 What leads to the problem?

12 What leads to the problem? Lack of systematic approach to avoid these bugs. No service provider is wiling to share the information.

13 What leads to the problem? Lack of systematic approach to avoid these bugs. No service provider is wiling to share the information.

14 Target Can we reduce such risk before the service selection of application developers? No service provider is wiling to share the information.

15 Solution: Risk-Based Service Selection

16 Solution: Risk-Based Service Selection Select services based on requirements. At-best effort to avoid potential bugs within services. Do not leak information of service providers.

17 Solution: Risk-Based Service Selection Select services based on requirements. At-best effort to avoid potential bugs within services. Do not leak information of service providers.

18 Solution: Risk-Based Service Selection Select services based on requirements. At-best effort to avoid potential bugs within services. Do not leak information of service providers.

19 Road-Map Motivating Example REaaS Design Evaluation

20 Road-Map Motivating Example REaaS Design Evaluation

21 Motivating Example

22 Motivating Example App Developer Service A Service B Service C

23 Motivating Example App Developer Select a service without overflow bugs Service A Service B Service C

24 Motivating Example App Developer ESaaS Service A Service B Service C

25 Motivating Example App Developer Service Score Service B 0.1 Service C 0.8 Service A 1.3 ESaaS Service A Service B Service C

26 Road-Map Motivating Example REaaS Design Evaluation

27 Road-Map Motivating Example REaaS Design Evaluation

28 REaaS Workflow App Developer ESaaS Service A Service B Service C

29 Step1: Service Registration App Developer ESaaS Service A Service B Service C

30 Step1: Service Registration App Developer ESaaS Service A Service B Service C

31 Step2: Requirement Submission App Developer ESaaS Service A Service B Service C

32 Step3: Risk Evaluation App Developer Service Score Service B 0.1 Service C 0.8 Service A 1.3 ESaaS Service A Service B Service C

33 Step1: Service Registration We developed a tool automatically getting dependency. Running on service side and very fast.

34 Step1: Service Registration

35 Step1: Service Registration

36 Step2: Requirement Submission

37 Step2: Requirement Submission Requirements include: - availability - integrity - confidentiality The options follow CVSS (an open bug DB)

38 Step3: Risk Evaluation

39 Step3: Risk Evaluation

40 Step3: Risk Evaluation Risk score of service i

41 Step3: Risk Evaluation Different bugs impact under different objects

42 Step3: Risk Evaluation Different bugs impact under different objects Gotten from CVSS + CVE

43 Step3: Risk Evaluation Different bugs impact under different objects Gotten from CVSS + CVE

44 Trust?

45 Trust? App Developer ESaaS Service A Service B Service C

46 Trust?? App Developer ESaaS? Service A Service B Service C

47 TPM-Based REaaS

48 TPM-Based REaaS App Developer ESaaS Service A Service B Service C

49 TPM-Based REaaS App Developer =hashcode(actions) ESaaS Service A Service B Service C

50 TPM-Based REaaS App Developer ESaaS Service A Service B Service C

51 TPM-Based REaaS App Developer ESaaS Service A Service B Service C

52 Road-Map Motivating Example REaaS Design Evaluation

53 Road-Map Motivating Example REaaS Design Evaluation

54 Case Study MySQL PostgreSQL Riak MongoDB # of packages Risk score

55 Performance Evaluation One Dell XPS14 laptop - 2.8GHz 4-Core Intel Xeon CPU - 16GB memory Public dataset with N packages - N = 10, 100, 1000, and 10000

56 Time for Dependency Collection Running time (seconds) no TPM With TPM # of packages within a service

57 Time for Risk Evaluation Running time (seconds) 1e no TPM With TPM # of packages within a service

58 Conclusion The first-step towards practical risk-based service selection approach. TPM-based approach to prevent privacy leakage. A realistic case study and performance evaluation.

59 Thanks!

XTM Web 2.0 Enterprise Architecture Hardware Implementation Guidelines. A.Zydroń 18 April 2009. Page 1 of 12

XTM Web 2.0 Enterprise Architecture Hardware Implementation Guidelines A.Zydroń 18 April 2009 Page 1 of 12 1. Introduction...3 2. XTM Database...4 3. JVM and Tomcat considerations...5 4. XTM Engine...5