- Lehrstuhl für Praktische Informatik (7)
Portability of Process-Aware and Service-Oriented Software: Evidence and Metrics
- Modern software systems are becoming increasingly integrated and are required to operate over organizational boundaries through networks. The development of such distributed software systems has been shaped by the orthogonal trends of service-orientation and process-awareness. These trends put an emphasis on technological neutrality, loose coupling, independence from the execution platform, and location transparency. Execution platforms supporting these trends provide context and cross-cutting functionality to applications and are referred to as engines.
Applications and engines interface via language standards. The engine implements a standard. If an application is implemented in conformance to this standard, it can be executed on the engine. A primary motivation for the usage of standards is the portability of applications. Portability, the ability to move software among different execution platforms without the necessity for full or partial reengineering, protects from vendor lock-in and enables application migration to newer engines.
The arrival of cloud computing has made it easy to provision new and scalable execution platforms. To enable easy platform changes, existing international standards for implementing service-oriented and process-aware software name the portability of standardized artifacts as an important goal. Moreover, they provide platform-independent serialization formats that enable the portable implementation of applications. Nevertheless, practice shows that service-oriented and process-aware applications today are limited with respect to their portability. The reason for this is that engines rarely implement a complete standard, but leave out parts or differ in the interpretation of the standard. As a consequence, even applications that claim to be portable by conforming to a standard might not be so.
This thesis contributes to the development of portable service-oriented and process-aware software in two ways: Firstly, it provides evidence for the existence of portability issues and the insufficiency of standards for guaranteeing software portability. Secondly, it derives and validates a novel measurement framework for quantifying portability. We present a methodology for benchmarking the conformance of engines to a language standard and implement it in a fully automated benchmarking tool. Several test suites of conformance tests for two different languages, the Web Services Business Process Execution Language 2.0 and the Business Process Model and Notation 2.0, allow to uncover a variety of standard conformance issues in existing engines. This provides evidence that the standard-based portability of applications is a real issue. Based on these results, this thesis derives a measurement framework for portability. The framework is aligned to the ISO/IEC Systems and software Quality Requirements and Evaluation method, the recent revision of the renowned ISO/IEC software quality model and measurement methodology. This quality model separates the software quality characteristic of portability into the subcharacteristics of installability, adaptability, and replaceability. Each of these characteristics forms one part of the measurement framework. This thesis targets each characteristic with a separate analysis, metrics derivation, evaluation, and validation. We discuss existing metrics from the body of literature and derive new extensions speciffically tailored to the evaluation of service-oriented and process-aware software. Proposed metrics are defined formally and validated theoretically using an informal and a formal validation framework. Furthermore, the computation of the metrics has been prototypically implemented. This implementation is used to evaluate metrics performance in experiments based on large scale software libraries obtained from public open source software repositories.
In summary, this thesis provides evidence that contemporary standards and their implementations are not sufficient for enabling the portability of process-aware and service-oriented applications. Furthermore, it proposes, validates, and practically evaluates a framework for measuring portability.
Context-aware applications in mobile distributed systems
The CHORCH Approach: How to Model B2Bi Choreographies for Orchestration Execution
- The establishment and implementation of cross-organizational business processes is an implication of today's market pressure for efficiency gains.
In this context, Business-To-Business integration (B2Bi) focuses on the information integration aspects of business processes.
A core task of B2Bi is providing adequate models that capture the message exchanges between integration partners.
Following the terminology used in the SOA domain, such models will be called choreographies in the context of this work.
Despite the enormous economic importance of B2Bi, existing choreography languages fall short of fulfilling all relevant
requirements of B2Bi scenarios.
Dedicated B2Bi choreography standards allow for inconsistent outcomes of basic interactions and
do not provide unambiguous semantics for advanced interaction models.
In contrast to this, more formal or technical choreography languages may provide unambiguous modeling semantics,
but do not offer B2Bi domain concepts or an adequate level of abstraction.
Defining valid and complete B2Bi choreography models becomes a challenging task in the face of these shortcomings.
At the same time, invalid or underspecified choreography definitions are particularly costly considering the organizational
setting of B2Bi scenarios.
Models are not only needed to bridge the typical gap between business and IT,
but also as negotiation means among the business users of the integration partners on the one hand
and among the IT experts of the integration partners on the other.
Misunderstandings between any two negotiation partners potentially affect the agreements between all other negotiation partners.
The CHORCH approach offers tailored support for B2Bi by combining the strengths of both dedicated B2Bi standards and formal rigor.
As choreography specification format, the ebXML Business Process Specification Schema (ebBP) standard is used.
ebBP provides dedicated B2Bi domain concepts such as so-called BusinessTransactions (BTs) that abstractly specify the exchange of a request business document
and an optional response business document.
In addition, ebBP provides a format for specifying the sequence of BT executions for capturing complex interaction scenarios.
CHORCH improves the offering of ebBP in several ways.
Firstly, the execution model of BTs which allows for inconsistent outcomes among the integration partners
is redefined such that only consistent outcomes are possible.
Secondly, two binary choreography styles are defined as B2Bi implementation contract format in order to streamline implementation projects.
Both choreography styles are formalized and provided with a formal execution semantics for ensuring unambiguity.
In addition, validity criteria are defined that ensure implementability using BPEL-based orchestrations.
Thirdly, the analysis of the synchronization dependencies of complex B2Bi scenarios is supported
by means of a multi-party choreography style combined with an analysis framework.
This choreography style also is formalized and standard state machine semantics are reused in order to ensure unambiguity.
Moreover, validity criteria are defined that allow for analyzing corresponding models for typical multi-party choreography issues.
Altogether, CHORCH provides choreography styles that are B2Bi adequate, simple, unambiguous, and implementable.
The choreography styles are B2Bi adequate in providing B2Bi domain concepts, in abstracting from low-level implementation details
and in covering the majority of real-world B2Bi scenarios.
Simplicity is fostered by using state machines as underlying specification paradigm.
This allows for thinking in the states of a B2Bi scenario and for simple control flow structures.
Unambiguity is provided by formal execution semantics whereas implementability (for the binary choreography styles) is ensured by providing
mapping rules to BPEL-based implementations.
The validation of CHORCH's choreography styles is performed in a twofold way.
Firstly, the implementation of the binary choreography styles based on Web Services and BPEL technology is demonstrated
which proves implementability using relatively low-cost technologies.
Moreover, the analysis algorithms for the multi-party choreography styles are validated using a Java-based prototype.
Secondly, an abstract visualization of the choreography styles based on BPMN is provided that abstracts from
the technicalities of the ebBP standard.
This proves the amenability of CHORCH to development methods that start out with visual models.
CHORCH defines how to use BPMN choreographies for the purpose of B2Bi choreography modeling
and translates the formal rules for choreography validity into simple composition rules that
demonstrate valid ways of connecting the respective modeling constructs.
In summary, CHORCH allows integration partners to start out with a high-level visual model of their interactions in BPMN
that identifies the types and sequences of the BusinessTransactions to be used.
For multi-party choreographies, a framework for analyzing synchronization dependencies then is available.
For binary choreographies, an ebBP refinement can be derived that fills in the technical parameters that are needed for deriving the implementation.
Finally, Web Services and BPEL based implementations can be generated.
Thus, CHORCH allows for stepwise closing the semantic gap between the information perspective of business process models
and the corresponding implementations.
It is noteworthy that CHORCH uses international standards throughout all relevant layers, i.e., BPMN, ebBP, Web Services and BPEL,
which helps in bridging the heterogeneous IT landscapes of B2Bi partners.
In addition, the adoption of core CHORCH deliverables as international standards of the RosettaNet community
give testament to the practical relevance and promise dissemination throughout the B2Bi community.
A Service Description Method for Service Ecosystems - Meta Models, Modeling Notations, and Model Transformations
- Globalization and rapid technological change elevates the role of the Internet in terms of business service offering and procurement. At the same time, companies specialize on core competencies on the one hand, and on the other hand, integrate with other firms into “service ecosystems” in order to serve market needs in a flexible manner. One challenge in this setting is how to develop and describe novel business services within service ecosystems for efficient trade in services over the Internet. This work proposes a method for describing business services that integrates into business service development processes. The development of such a method leads to three major challenges: Firstly, it is necessary to determine which properties are appropriate for describing business services. This work analyzes existing approaches in the marketing, information systems, and computer science domain and develops a model for a formal description that facilitates offering and discovering of business services. Secondly, business service description elicitation, documentation, and communication must be provided for the whole business service development process. This work’s approach includes the development of an appropriate modeling notation as an extension of the Unified Modeling Notation (UML). Thirdly, there is a need for transforming business service descriptions into software realization languages that are suitable for the Internet. This contribution offers an automatic transformation of business service descriptions into Web Services Description Language (WSDL) documents using model-to-model transformation scripts. The method for describing business services was evaluated by implementing an integrated modeling environment along with related transformation scripts as well as by two case studies in the insurance and IT outsourcing industry.
A Realistic Approach for the Autonomic Management of Component-Based Enterprise Systems
- During the last decades, information technology has been characterized by constantly increasing performance of available hardware resources. This development allows the assignment of more and more complex tasks to software systems while at the same time leading to a massive increase of inherent complexity of applied systems. The expected further increase of complexity in the future demands for an explicit addressing of complexity. The concept of Component Orientation represents an approach for complexity reduction during the development and configuration of software through functional decomposition. With the vision of Autonomic Computing there does exist an approach for addressing complexity during the operation and maintenance of software systems. In this context, the approach is based on the idea of assigning low level-management tasks to the managed system itself. The concept of Component Orientation leads to the establishment of system architectures out of clearly distinguishable building blocks. Therefore, Component Orientation seems to provide a promising foundation for realizing the vision of Autonomic Computing. This thesis presents a realistic infrastructure for the autonomic management of component-based enterprise systems. The application area of such systems leads to special requirements for managed systems and is highly affected by the complexity problem. As a foundation for the proposed approach, a well established component standard was chosen to guarantee the practical relevance of applied concepts and techniques. The applied standard is Enterprise JavaBeans, version 3.0. The proposed infrastructure is designed and realized in a generic fashion. It provides a platform upon which solutions for different application areas of Autonomic Computing can be realized. Autonomic entities are supported through a programming interface which represents a system on three interrelated levels and allows its management: On the top-level, the underlying software of a managed system is considered. The middle layer addresses the system architecture. Runtime interactions within the system are represented on the lowest layer. On this foundation, a system can be managed in a holistic, model-based way. The runtime management of a system is enabled through a specially developed component which must be integrated into the affected environment. This component is compliant with the applied component standard and does not require any adjustment of the underlying component platform. Finally, a tool is provided which supports the establishment of manageability through the automated execution of required adjustments of components. The management of a system is realized transparently for its constituent elements during runtime. On the whole, the development of enterprise software is not affected by a potential application of the presented infrastructure.
Privacy-enhancing Technologies for Private Services
- Privacy on the Internet is becoming more and more important, as an increasing part of everyday life takes place over the Internet. Internet users lose the ability to control which information they give away about themselves or are even not aware that they do so. Privacy-enhancing technologies help control private information on the Internet, for example, by anonymizing Internet communication. Up to now, work on privacy-enhancing technologies has mainly focused on privacy of users requesting public services. This thesis introduces a new privacy risk that occurs when private persons run their own services. One example are instant messaging systems which allow users to exchange presence information and text messages in real time. These systems usually do not provide protection of presence information which is stored on central servers. As an alternative, decentralized instant messaging system designs mitigate this problem by having private persons provide instant messaging services to each other. However, providing a service as a private person causes new security problems as compared to providing a service as an organization or enterprise: First, the presence of such a service reveals information about the availability of the service provider. Second, the server location needs to be concealed in order to hide the whereabouts of a person. Third, the server needs to be specifically protected from unauthorized access attempts. This thesis proposes to use pseudonymous services as a building block for private services. Pseudonymous services conceal the location of a server that provides a specific service. The contribution made here is to analyze what parts of pseudonymous services, in particular Tor hidden services, are missing in order to apply them for private services. This analysis leads to three main problems for which solutions are proposed: First, known pseudonymous service designs do not scale to the expected number of private services which might be provided in the future. This thesis proposes a new approach to store hidden service descriptors in a distributed data structure rather than on central servers. A particular focus lies on the support of private entries which are required for private services. Second, pseudonymous services leak too much information about service identity during advertisement in the network and connection establishment by clients. The approach taken in this thesis is to reduce the information that a service publishes in the network to a minimum and prevent unauthorized clients from accessing a service already during connection establishment. These changes protect service activity and usage patterns from non-authorized entities. Third, pseudonymous services exhibit worse performance than direct service access. The contribution of this thesis is to measure performance, identify possible problems, and propose improvements.
On the Application of the Service-Oriented Architectural Style to Heterogeneous Application Landscapes
- This thesis investigates the application of the service-oriented architectural style in the context of industrial enterprises. This style provides a commonly perceived paradigm for organizing distributed software systems. However, beyond general attention to this style, there are only few descriptions of the difference between service orientation and more mature styles, such as component orientation. This dissertation argues that the service-oriented style is an approach that centralizes control over distributed functionality that is provided by the application systems of an organization. This means that service orientation is a paradigm for application integration. Moreover, we argue that it is not possible to fully formalize the inherent principles of service orientation as part of an architectural style description. In fact, soft design principles are a differentiator of this style. These principles, however, are rarely applied in the context of industrial enterprises. This is why we analyze how such design principles could be objectively described and what attention should be paid to them. This analysis is performed by categorizing the potential benefits of this style and assigning the respective underlying principles to the identified benefits. Subsequently, a reference architecture is defined on the basis of these findings. This architecture focuses on structuring service-oriented applications - so-called composite applications. In order to apply the defined reference architecture in the context of actual projects, we describe a design methodology for composite applications. This design methodology focuses on using business processes for designing various types of services and on describing their interconnections by the reference architecture. To achieve this, a service design algorithm is included that derives services from business processes by incorporating the results of a statistical analysis of service design principles. The result of this methodology is a platform-independent design of a composite application. It considers the restrictions of the application landscape in which a composite will be deployed. To permit the realization of composite applications, we informally map the platform-independent reference architecture to a platform that is widely used in industrial enterprises. This mapping is, together with the design methodology and the reference architecture, applied to an industry-scale use case. This way, the applicability of the concepts is demonstrated.