Trustworthy Ambient Systems: Resource Constrained Ambience

通信和网络技术的进步使设计“环境”系统成为可能，在这种系统中，移动设备和软件代理组成特别小组，交易数据和服务。然而，在如此复杂的系统中产生信任以及它们对故障和攻击的弹性所需要的技术还处于起步阶段。TrAmS平台资助了一个研究小组，该小组在技术基础、方法和工具方面创建了新的项目，以模拟、设计和分析值得信赖的环境系统。然而，TrAmS-2受到了一些新因素的影响。首先，设备的供电/消耗，而不是成本，正在成为环境系统部署的限制因素。其次，云计算等新范例提供了一种新的环境维度，在这种环境中，数据和程序可以在没有代理的物理移动的情况下迁移。因此，环境系统可以将移动设备与移动软件和服务结合起来，按需使用资源。这增加了诸如电源丢失/限制以及在按需计算基础设施中缺乏信任等威胁的重要性。这些因素意味着支撑容错、可靠系统工程的传统假设将受到挑战。TrAmS使正式工程方法、证明支持、嵌入式系统设计、动态联盟和基于合同的“系统的系统”架构的查询线成为可能。这导致了9个EPSRC，欧盟，工业和其他项目，应用于汽车，铁路，空间，商业和其他部门。具体产出包括容错建模的工具和模式、证明技术的进步、支持正式工程方法部署的仿真和证据。在TrAmS-2中，该小组将专注于资源有限的未来环境系统中最具挑战性的方面。除了容错性之外，这还需要其他领域的技能，因此我们扩大了TrAmS团队与系统和微电子学的研究人员，以创建一个在可靠性，数据管理和异步系统方面具有国际知名度的团队。TrAmS-2将提供研究人员的连续性，鼓励在这种新的专业知识组合所创造的领域进行新的、有风险的研究。可信赖的环境系统的设计和管理必然是一项合作的、大规模的、可能容易出错的工作，部分原因是它们不能作为一个连贯的整体来设计。移动性（物理的和虚拟的）使它们容易受到恶意和意外故障的影响，而这些故障在设计中很难预测。去中心化使得可控的恢复和演化变得困难。缺电会使组件崩溃，但容错会消耗额外的电力。复杂的环境系统产生的验证问题超出了最先进的工具。TrAmS-2在四个领域解决了这些挑战：基础：努力实现足够丰富的演算，以描述由多个用户和所有者组成的不同服务的环境系统的架构、功能和随机特性。工具：探索协作式、支持云计算的设计环境的开发，简化分析服务的访问，允许根据需要将全方位的交互式验证技术应用于环境系统设计。易处理的设计：通过添加工具来管理增加的错误检测和恢复的复杂性，在不丢失底层系统结构的情况下，努力使可信赖的环境系统设计更易于处理。能源感知环境系统：探索能源感知和弹性之间的相互作用，以及对能源引发的威胁提供可预测的耐受性。最后，TrAmS-2将使该小组继续从战略角度看待其研究，并将通过为各级小组成员建立一个导师小组，建立新的联系和交流，促进进一步的项目，帮助发展其成员的职业生涯。

Advances in communications and networking technology have made it possible to devise 'ambient' systems in which mobile devices and software agents form ad hoc groups, trading data and services. However, the technology needed to engender trust in such complex systems, and their resilience to faults and attacks, is only in its infancy. The TrAmS platform grant sustained a research group that created new projects on technical foundations, methods and tools to model, design and analyse Trustworthy Ambient Systems. TrAmS-2 is, however, shaped by new factors. First, power provision/consumption of devices, rather than cost, is becoming a limiting factor in the deployment of ambient systems. Second, novel paradigms such as cloud computing offer a new dimension of ambience in that data and programs can be migrated without physical movement of agents. Ambient systems can therefore mix mobile devices with mobile software and services, using resources on demand. This increases the significance of threats such as power loss/limitation, and lack of trust in an on-demand computing infrastructure. These factors mean that traditional assumptions underpinning the engineering of fault-tolerant, dependable systems will be challenged. TrAmS enabled lines of enquiry on formal engineering methods, proof support, embedded systems design, dynamic coalitions and contract-based "systems of systems" architectures. These led to 9 EPSRC, EU, industry and other projects with applications in automotive, rail, space, business and other sectors. Concrete outputs included tools and patterns for fault tolerance modelling, advances in proof technology, simulation and evidence to support deployment of formal engineering methods. In TrAmS-2, the group will focus on the most challenging aspects of resource-limited future ambient systems. This requires skills in other areas besides fault tolerance, so we have augmented the TrAmS team with researchers in systems and microelectronics to create a group with an international profile in dependability, data management and asynchronous systems. TrAmS-2 will provide continuity of research staff, encouraging new, risky, research in areas created by this new mix of expertise. The design and management of trustworthy ambient systems is necessarily a cooperative, large-scale, and potentially error-prone undertaking, partly because they cannot be designed as a coherent whole. Mobility (physical and virtual) makes them open to malicious and accidental failures that are difficult to predict in design. Decentralisation makes controlled recovery and evolution difficult. Lack of power can crash components, but fault tolerance costs extra power. Complex ambient systems yield verification problems beyond state-of -the-art tools. TrAmS-2 addresses these challenges in four domains: Foundations: work towards calculi that are rich enough to describe the architectures, functionality and stochastic properties of ambient systems composed of diverse services with multiple users and owners. Tools: exploring the development of cooperative, cloud-enabled design environments that ease access to analytic services to allow the full range of interactive verification techniques to be applied on demand to ambient system designs.Tractable Design: work towards making design of trustworthy ambient systems designs more tractable by adding facilities to manage the added complexity of error detection and recovery without losing the underlying system structure. Energy-Aware Ambient Systems: exploring the interplay between energy-awareness and resilience, and the provision of predictable tolerance of energy-induced threats. Finally, TrAmS-2 will allow the group to continue taking a strategic view of its research and will help develop the careers of its members by building a group of mentors for the team members at all levels, establishing new links and exchanges, leading to further projects.