1 / 45

NESSI: delivering building blocks for the Internet of Services

NESSI: delivering building blocks for the Internet of Services. New Architectures for Future Internet, Campinas, 24..09.2009. Aljosa Pasic, Atos Origin. Agenda. The story of NESSI Future Internet (of services) Building blocks for IoS Closer look at security for IoS Conclusions.

psyche
Télécharger la présentation

NESSI: delivering building blocks for the Internet of Services

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. NESSI: delivering building blocks for the Internet of Services New Architectures for Future Internet, Campinas, 24..09.2009. Aljosa Pasic, Atos Origin

  2. Agenda • The story of NESSI • Future Internet (of services) • Building blocks for IoS • Closer look at security for IoS • Conclusions

  3. The story of NESSI • The context - European Technology Platform • Private-public partnership • Industrial leadership • Uniting all stakeholders • Around a key, strategic area • Strategic? • Europe’s future growth • Europe’s competitiveness • Link? • Requires major research and technological advances • In the medium to long term NESSI aims to provide a unified view for European research in Services Architectures and Software Infrastructures Today, NESSI partners represent 1.7 Million strong workforce and 490 B€ in revenues NESSI has presented an initial Strategic Research Agenda that represents a global investment of 2.5 B€

  4. NESSI’s governance Board Committees NESSI Office NESSI partners Coordinating Committees Committees Committees Steering Committee Research Projects • NESSI members • ActivelyContributing • to NEXOF • to the SRA Research Projects Research Projects Working Group Research Projects Research Projects StayingAware Newsletters Events Mailings

  5. NESSI’s constituency NESSI partners Coordinating 400 members 12 working groups6 NESSI Strategic Projects 5 NESSI Compliant Projects • NESSI members • ActivelyContributing • to NEXOF • to the SRA StayingAware

  6. ETP or JTI? ETP – EuropeanTechnology Platform JTI – Joint Technology Initiative Over 30 ETPs – 6 JTIs • InnovativeMedicines Initiative (IMI) • Embedded Computing Systems (ARTEMIS) • Aeronautics and Air Transport (Clean Sky) • Nanoelectronics Technologies 2020 (ENIAC) • Fuel Cells and Hydrogen (FCH) • Global Monitoring for Environment and Security (GMES) ETPs http://cordis.europa.eu/technology-platforms/home_en.html JTI http://cordis.europa.eu/fp7/jtis/

  7. NESSI at a glance 2 0 0 7 2 0 0 8 2 0 1 2 2 0 0 6 2 0 0 5

  8. Agenda The story of NESSI Future Internet (of services) Building blocks for IoS Closer look at security for IoS Conclusions

  9. NESSI in Future Internet VIRTUAL Tomorrow the Internet will be strategic because of “services” REAL AMBIENT NETWORKS & PERVASIVE COMPUTING

  10. Future Internet Assembly European Commission 10

  11. EU Economy Business Services Holistic Model NESSI Landscape NESSI Adoption Core Services NESSI Adoption NESSI Framework

  12. EU Economy Business Services Holistic Model NESSI Landscape NESSI Adoption Core Services Practices & Usages NESSI Adoption Architecture & Engineering Regulatory Governance NESSI Framework Define and implement

  13. Agenda The story of NESSI Future Internet (of services) Building blocks for IoS Closer look at security for IoS Conclusions

  14. The tools of NESSI • The first “tool” of an ETP is its Strategic Research Agenda • Moving from vision to definition • Frame the context • Refine the Technological scope    NEXOFNESSI Open Service Framework

  15. The tools of NESSI • The first “tool” of an ETP is its Strategic Research Agenda • Moving from vision to definition • Frame the context • Refine the Technological scope • Enhance definition of NEXOF – the NESSI Open Service Framework • Build it “together” 2 0 12 2 0 0 8

  16. Contributing to NEXOF Contributing to NEXOF – a world-wide process Contributing key components to NEXOF - Open to all- Participative selection process Compliant to NEXOFor Contributing to NEXOF

  17. Contributing to NEXOF Contributing to NEXOF – a world-wide process

  18. RequirementsCapture offered asservices Engineering tools Interaction Services End user Interface Service consumers Monitoring ContextModelling System Platform Consumer Adaptation Mapping users perspectives to business/Integration Context Handling KnowledgeModelling SVNModeling Information Services Business Process Execution SVN LifecycleManagement BPM view Business ProcessModeling Composition Service Coordination Mediation SLA Negotiation Service Discovery SBS/SBAModelling ServiceCommunication Service Platform ServiceExecution Service Registration LifecycleManagement Service Reasoning Integration Services Service Modelling External Services Native Services Infrastructure and DataAbstraction Infrastructure Modelling Infrastructure ResourcesManagement Data Management

  19. SLA@SOI Engineering tools Interaction Services End user Interface Service consumers Monitoring ContextModelling SOA4ALL RESERVOIR System Platform Consumer Adaptation Mapping users perspectives to business/Integration Context Handling MASTER KnowledgeModelling EzWeb SVNModeling Information Services Business Process Execution SVN LifecycleManagement BPM view Business ProcessModeling Composition Service Coordination Mediation SLA Negotiation Service Discovery SBS/SBAModelling ServiceCommunication Service Platform ServiceExecution Service Registration LifecycleManagement Service Reasoning Integration Services Service Modelling External Services Native Services Infrastructure and DataAbstraction Infrastructure Modelling Infrastructure ResourcesManagement Data Management

  20. Agenda The story of NESSI Future Internet (of services) Building blocks for IoS Closer look at security for IoS Conclusions

  21. Service Oriented World Applications will need to utilise shared and co-owned services out of different domains of control that require to obey separate security policies and ask for diverse security and dependability qualities

  22. Challenges “A trustworthy Internet with services that you trust” The technical base that makes the Internet a safer place Address long-term research and industry vision on trust, security and dependability in software and services

  23. Coming problems For industry: Demand for Secure software is much higher than available security expertise For research/technology: New complex scenarios (e.g. ambient intelligence) introduce security issues not addressed by conventional engineering processes For market consultants: Security properties difficult to measure and it is also difficult to evaluate their “compositional effects” For users: Security segmentation and market definitions are blurring: “service infrastructure” covers network infrastructure, perimeter, desktop, server and application security For auditors and lawyers: Who is accountable and liable for what? For society: Trust becomes a “key enabler” for service provision and use For everyone: How much should we spend on security?

  24. Some Research Topics Security Technologies “Embedded” in Services Services at the component level of the Service-Oriented Architecture Specialised Security Services and Properties Access control architecture and its implementation System-wide Security Characteristics Holistic implementation of the secure service eco-system. Dependability and Availability. Human/Societal/Technical Trust elements The human & machine perception of System Trustworthiness. Privacy, digital rights… Governmental and Societal Context Policy, Regulation, Certification, Awareness, Security Stakeholders Mapping…

  25. TSD “grey” context boundaries If computing sky is getting “cloudy”…TSD will depend on “weather conditions”… Infrastructure view: Expanding boundary (include remote access PC) and/or Contracting boundary (exclude outsourcing staff PC, external B2B server…) Trust view: “trust zones” where a level of trust can be established and security controls can be enforced E2E Security or Dependability levels: closed, semi-open or open “servicenets” ?

  26. Security Dimensions in Service Infrastructures Secure Services Security as a service Securing Services

  27. What should it be? • Dynamic • Adaptable • Composable • Measurable • Predictive • Scalable • Persuasive • Open • Trustworthy • Interoperable • In TSD engineering and modelling • In TSD control and management • In TSD level assurance Approaches, properties and research challenges

  28. …which brings many trade-off issues… Privacy Availability Scalability Data integrity Accountability Assurance

  29. Metrics for Trust, Security & Dependability a) b) c)

  30. FP6 FP7 Biometrics Privacy, identity Network Services Secure Implementation Trusted Computing Coordination Action THINK-TRUST FORWARD SecurIST ESFORS PARSIFAL AMBER

  31. More on trust and trustworthiness… In a service-centric Internet: Use and adoption of services depends highly on TRUST and TRUSTWORTHINESS The trust model relies on complete requirements that include business, technical, legal, regulatory, and societal requirements PrimeLife

  32. We need more than technology : an example Risk management failure; a trader (Jerome Kerviel) was able to turn off the monitoring controls which should have alerted the organization to a magnitude of risk which put the organization in danger. Governance failure; when the French Banking Commission detected Kerviel's activity and warned Societe Generale (SocGen) that its risk management regime was not working properly, SocGen management apparently failed to take effective action to fix the problem. Identifying in time both failures and who in the organization is responsible for addressing each failure is a lesson learnt for other companies which might face in the future similar problems.

  33. MASTER approach: align and manage GRC tool structure should have “roundtrip” processes. Management at all levels should have effective tools for understanding the information and reports it receives, including the ability to “drill down” into information to see the details provided by staff at all levels. Compliance Management solution, such as MASTER can help implement roundtrip processes. Different interfaces for different people. Conceptual Model MASTER Architecture Design-Time Workbench Methodology Assessement Cockpit Online Enforcement Run-time Monitoring and Signalling

  34. Outsource people, processes, resources... Outsourcing Outsourcing Outsourcing Outsourcing Outsourcing Regulators Standards Bodies Best practices Offshore 34

  35. Compliance Management in MASTER Designing Methods and tools for selecting and integrating controls Monitoring Collecting evidence for the measurement of operation and effectiveness of controls. Assessment Evaluation of status of compliance Enforcement Ensuring controls are applied Reacting when controls fail MASTER integrated project (Feb 2008-Feb 2011) Industry Atos Origin (ES), SAP AG (DE), Engineering (IT), British Telecom (UK), IBM (CH), ANECT (CZ), Deloitte (FR) Academia Lero (IE), University of Trento (IT), ETH (CH), University of Stuttgart (DE), SINTEF ICT (NO) End user CESCE (ES), Hospital San Raffaele (IT) = Control process Organization Service Provision 35

  36. Decompose compliance/control objectives Control Objectives Can be decomposed Means-end analysis Risk-assessment Control Activities Can be decomposed Process/temporal constructs Enforcement and auditing language constructs Control service Description of step-by-step control mechanisms Target/Value Goals Can be decomposed Business process engineering This is outside the MASTER process. Target Activities (business process) Can be decomposed Again outside MASTER Impact of control steps over value steps must be considered Target service Controls Controls Controls

  37. Business Process Control Process Event going into control process Event coming out of control process Event not modified by control process

  38. BP step BP step BP step Control step Control step Control step In SOA world…

  39. KSI (correctness) Event going into control process € 7,145.56 Event coming out of control process Event not modified by control process Compliant event (trace) Non-compliant event (trace)

  40. Standardization and reusability Control Objectives: security goals need to be satisfied to be compliant PRMB CO9 CO4 Control activities and steps: • Derived from a set of required COs • From specification of high level COs to operational policies CO8 CO4 COM CO2 Protection Model: is a set of controls whose enforcement, monitoring and assessment guarantees an experimentally and/or formally assessed level of compliance CO1 PRMA CON PRMC Possibility to leverage on existing PRMs and re-using existing ones (or part of) in defining new PRMs

  41. Key building block for FI: Identity STORK is a large scale pilot in the ICT-PSP (ICT Policy Support Programme), under the CIP (Competitiveness and Innovation Programme), and co-funded by EU. It aims at implementing an EU wide interoperable system for recognition of eID and authentication that will enable businesses, citizens and government employees to use their national electronic identities in any Member State. It will also pilot transborder eGovernment identity services and learn from practice on how to roll out such services, and to experience what benefits and challenges an EU wide interoperability system for recognition of eID will bring. The STORK interoperable solution for electronic identity (eID) is based on a distributed architecture that will pave the way towards full integration of EU e-services while taking into account specifications and infrastructures currently existing in EU Member States. The solution provided is intended to be robust, transparent, safe to use and scalable, and should be implemented in such a way that it is sustainable beyond the life of the pilot.

  42. Agenda The story of NESSI Future Internet (of services) Building blocks for IoS Closer look at security for IoS Conclusions

  43. The importance of the global collaboration • Future Internet – an opportunity for collaboration • Similar initiatives exist in several countries end-to-end location-ind. services the best of all communities optimise resources ETPs • Validate the best competitive applications and usage scenarios worldwide • Avoid reinventing the wheel • Many companies are present worldwide • Many countries have specific excellence • Multiple disciplines and knowledge domains are needed • No single domain delivers end-to-end user scenarios • Global convergence is only implemented by a common approach and shared process

  44. Conclusions We need to invest in research GLOBALLY in order to ensure continued trust by users as society increases its dependency on software services Software security engineering, in its road to maturity, could & should use lessons learned from the software engineering and from the system security, but also other disciplines and research communities

  45. Thank you FACING TECHNOLOGICAL CHALLENGES TOGETHER Aljosa Pasic (Atos Origin)aljosa.pasic@atosorigin.com

More Related