Trustworthy Ambient Systems: Resource Constrained Ambience

通信和网络技术的进步使设计“环境”系统成为可能，在该系统中，移动设备和软件代理组成特别小组，交换数据和服务。然而，在如此复杂的系统中建立信任所需的技术，以及它们对故障和攻击的恢复能力，还处于初级阶段。有轨电车平台拨款支持了一个研究小组，该小组在技术基础、方法和工具方面创建了新的项目，以建模、设计和分析值得信赖的环境系统。然而，有轨电车-2受到新因素的影响。首先，设备的电力供应/消耗，而不是成本，正在成为环境系统部署的限制因素。其次，云计算等新模式提供了一种新的氛围，数据和程序可以在没有代理物理移动的情况下迁移。因此，环境系统可以将移动设备与移动软件和服务混合在一起，按需使用资源。这增加了断电/限制以及对按需计算基础设施缺乏信任等威胁的重要性。这些因素意味着，支撑容错、可靠系统工程的传统假设将受到挑战。有轨电车系统提供了关于正式工程方法、证明支持、嵌入式系统设计、动态联盟和基于合同的“系统系统”架构的咨询热线。这些项目导致了EPSRC、欧盟、工业等9个项目在汽车、铁路、航天、商业等领域的应用。具体产出包括用于容错建模的工具和模式、证明技术的进步、支持部署正式工程方法的模拟和证据。在有轨电车-2中，该小组将专注于资源有限的未来环境系统中最具挑战性的方面。这需要除容错之外的其他领域的技能，因此我们扩大了有轨电车团队，增加了系统和微电子方面的研究人员，以创建一个在可靠性、数据管理和异步系统方面具有国际知名度的团队。TRAMS-2将为研究人员提供连续性，鼓励在这种新的专业知识组合所创造的领域进行新的、有风险的研究。值得信赖的环境系统的设计和管理必然是一项合作的、大规模的、可能容易出错的工作，部分原因是它们不能被设计为一个连贯的整体。移动性(物理和虚拟)使它们容易受到设计中难以预测的恶意和意外故障的影响。权力下放使有控制的复苏和演变变得困难。缺乏电力可能会导致组件崩溃，但容错需要额外的电力。复杂的环境系统产生的验证问题超出了最先进的工具。TRAMS-2在四个领域解决了这些挑战：基础：致力于建立足够丰富的演算，以描述由具有多个用户和所有者的不同服务组成的环境系统的体系结构、功能和随机属性。工具：探索协作、支持云的设计环境的开发，这些环境便于访问分析服务，以允许按需将全方位的交互验证技术应用于环境系统设计。可跟踪设计：通过添加设施来管理错误检测和恢复的额外复杂性，而不会丢失底层系统结构，从而使值得信赖的环境系统设计更易于处理。能源感知环境系统：探索能源感知和恢复力之间的相互作用，以及对能源引发的威胁提供可预测的容忍度。最后，TRAMS-2将允许该小组继续从战略的角度看待其研究，并将通过为各级小组成员建立一组导师，建立新的联系和交流，从而促进进一步的项目，帮助其成员发展职业生涯。

Advances in communications and networking technology have made it possible to devise 'ambient' systems in which mobile devices and software agents form ad hoc groups, trading data and services. However, the technology needed to engender trust in such complex systems, and their resilience to faults and attacks, is only in its infancy. The TrAmS platform grant sustained a research group that created new projects on technical foundations, methods and tools to model, design and analyse Trustworthy Ambient Systems. TrAmS-2 is, however, shaped by new factors. First, power provision/consumption of devices, rather than cost, is becoming a limiting factor in the deployment of ambient systems. Second, novel paradigms such as cloud computing offer a new dimension of ambience in that data and programs can be migrated without physical movement of agents. Ambient systems can therefore mix mobile devices with mobile software and services, using resources on demand. This increases the significance of threats such as power loss/limitation, and lack of trust in an on-demand computing infrastructure. These factors mean that traditional assumptions underpinning the engineering of fault-tolerant, dependable systems will be challenged. TrAmS enabled lines of enquiry on formal engineering methods, proof support, embedded systems design, dynamic coalitions and contract-based "systems of systems" architectures. These led to 9 EPSRC, EU, industry and other projects with applications in automotive, rail, space, business and other sectors. Concrete outputs included tools and patterns for fault tolerance modelling, advances in proof technology, simulation and evidence to support deployment of formal engineering methods. In TrAmS-2, the group will focus on the most challenging aspects of resource-limited future ambient systems. This requires skills in other areas besides fault tolerance, so we have augmented the TrAmS team with researchers in systems and microelectronics to create a group with an international profile in dependability, data management and asynchronous systems. TrAmS-2 will provide continuity of research staff, encouraging new, risky, research in areas created by this new mix of expertise. The design and management of trustworthy ambient systems is necessarily a cooperative, large-scale, and potentially error-prone undertaking, partly because they cannot be designed as a coherent whole. Mobility (physical and virtual) makes them open to malicious and accidental failures that are difficult to predict in design. Decentralisation makes controlled recovery and evolution difficult. Lack of power can crash components, but fault tolerance costs extra power. Complex ambient systems yield verification problems beyond state-of -the-art tools. TrAmS-2 addresses these challenges in four domains: Foundations: work towards calculi that are rich enough to describe the architectures, functionality and stochastic properties of ambient systems composed of diverse services with multiple users and owners. Tools: exploring the development of cooperative, cloud-enabled design environments that ease access to analytic services to allow the full range of interactive verification techniques to be applied on demand to ambient system designs.Tractable Design: work towards making design of trustworthy ambient systems designs more tractable by adding facilities to manage the added complexity of error detection and recovery without losing the underlying system structure. Energy-Aware Ambient Systems: exploring the interplay between energy-awareness and resilience, and the provision of predictable tolerance of energy-induced threats. Finally, TrAmS-2 will allow the group to continue taking a strategic view of its research and will help develop the careers of its members by building a group of mentors for the team members at all levels, establishing new links and exchanges, leading to further projects.