Search

Imperative session types provide an imperative interface to session-typed communication. In such an interface, channel references are first-class objects with operations that change the typestate of the channel. Compared to functional session type APIs, the program structure is simpler at the surface, but typestate is required to model the current state of communication throughout. Following an early work that explored the imperative approach, a significant body of work on session types has neglected the imperative approach and opts for a functional approach that uses linear types to manage channel references soundly. We demonstrate that the functional approach subsumes the early work on imperative session types by exhibiting a typing and semantics preserving translation into a system of linear functional session types. We further show that the untyped backwards translation from the functional to the imperative calculus is semantics preserving. We restrict the type system of the functional calculus such that the backwards translation becomes type preserving. Thus, we precisely capture the difference in expressiveness of the two calculi and conclude that the lack of expressiveness in the imperative calculus is largely due to restrictions imposed by its type system.

This paper studies the economic utilities and the quality of service (QoS) in a two-sided non-neutral market where Internet service providers (ISPs) charge content providers (CPs) for the content delivery. We propose new models on a two-sided market which involves a CP, an ISP, end users and advertisers. The CP may have either the subscription revenue model (charging end users) or the advertisement revenue model (charging advertisers). We formulate the interactions between the ISP and the CP as a noncooperative game problem for the former and an optimization problem for the latter. Our analysis shows that the revenue model of the CP plays a significant role in a non-neutral Internet. With the subscription model, both the ISP and the CP receive better (or worse) utilities as well as QoS in the presence of side payment at the same time. However, with the advertisement model, the side payment impedes the CP from investing on its contents., Comment: 15 pages, 10 figures

Part 2: Coordination Languages; International audience; Reactive programming (RP) languages and Synchronous Coordination (SC) languages share the goal of orchestrating the execution of computational tasks, by imposing dependencies on their execution order and controlling how they share data. RP is often implemented as libraries for existing programming languages, lifting operations over values to operations over streams of values, and providing efficient solutions to manage how updates to such streams trigger reactions, i.e., the execution of dependent tasks. SC is often implemented as a standalone formalism to specify existing component-based architectures, used to analyse, verify, transform, or generate code. These two approaches target different audiences, and it is non-trivial to combine the programming style of RP with the expressive power of synchronous languages.This paper proposes a lightweight programming language to describe component-based Architectures for Reactive systems, dubbed ARx, which blends concepts from RP and SC, mainly inspired to the Reo coordination language and its composition operation, and with tailored constructs for reactive programs such as the ones found in ReScala. ARx is enriched with a type system and with algebraic data types, and has a reactive semantics inspired in RP. We provide typical examples from both the RP and SC literature, illustrate how these can be captured by the proposed language, and describe a web-based prototype tool to edit, parse, and type check programs, and to animate their semantics.

Part 4: Machine Learning for Systems; International audience; The mobile ecosystem is witnessing an unprecedented increase in the number of malware in the wild. To fight this threat, actors from both research and industry are constantly innovating to bring concrete solutions to improve security and malware protection. Traditional solutions such as signature-based anti viruses have shown their limits in front of massive proliferation of new malware, which are most often only variants specifically designed to bypass signature-based detection. Accordingly, it paves the way to the emergence of new approaches based on Machine Learning (ML) technics to boost the detection of unknown malware variants. Unfortunately, these solutions are most often underexploited due to the time and resource costs required to adequately fine tune machine learning algorithms. In reality, in the Android community, state-of-the-art studies do not focus on model training, and most often go through an empirical study with a manual process to choose the learning strategy, and/or use default values as parameters to configure ML algorithms. However, in the ML domain, it is well known admitted that to solve efficiently a ML problem, the tunability of hyper-parameters is of the utmost importance. Nevertheless, as soon as the targeted ML problem involves a massive amount of data, there is a strong tension between feasibility of exploring all combinations and accuracy. This tension imposes to automate the search for optimal hyper-parameters applied to ML algorithms, that is not anymore possible to achieve manually. To this end, we propose a generic and scalable solution to automatically both configure and evaluate ML algorithms to efficiently detect Android malware detection systems. Our approach is based on devOps principles and a microservice architecture deployed over a set of nodes to scale and exhaustively test a large number of ML algorithms and hyper-parameters combinations. With our approach, we are able to systematically find the best fit to increase up to 11% the accuracy of two state-of-the-art Android malware detection systems.

Part 1: Full Papers; International audience; Neural networks (NN) are taking over ever more decisions thus far taken by humans, even though verifiable system-level guarantees are far out of reach. Neither is the verification technology available, nor is it even understood what a formal, meaningful, extensible, and scalable testbed might look like for such a technology. The present paper is a modest attempt to improve on both the above aspects. We present a family of formal models that contain basic features of automated decision making contexts and which can be extended with further orthogonal features, ultimately encompassing the scope of autonomous driving. Due to the possibility to model random noise in the decision actuation, each model instance induces a Markov decision process (MDP) as verification object. The NN in this context has the duty to actuate (near-optimal) decisions. From the verification perspective, the externally learnt NN serves as a determinizer of the MDP, the result being a Markov chain which as such is amenable to statistical model checking. The combination of a MDP and a NN encoding the action policy is central to what we call “deep statistical model checking” (DSMC). While being a straightforward extension of statistical model checking, it enables to gain deep insight into questions like “how high is the NN-induced safety risk?”, “how good is the NN compared to the optimal policy?” (obtained by model checking the MDP), or “does further training improve the NN?”. We report on an implementation of DSMC inside The Modest Toolset in combination with externally learnt NNs, demonstrating the potential of DSMC on various instances of the model family.

Threshold guards are a basic primitive of many fault-tolerant algorithms that solve classical problems of distributed computing, such as reliable broadcast, two-phase commit, and consensus. Moreover, threshold guards can be found in recent blockchain algorithms such as Tendermint consensus. In this tutorial, we give an overview of the techniques implemented in Byzantine Model Checker (ByMC). ByMC implements several techniques for automatic verification of threshold-guarded distributed algorithms. These algorithms have the following features: (1) up to t of processes may crash or behave Byzantine; (2) the correct processes count messages and make progress when they receive sufficiently many messages, e.g., at least \documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$t+1$$\end{document}; (3) the number n of processes in the system is a parameter, as well as t; (4) and the parameters are restricted by a resilience condition, e.g., \documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$n > 3t$$\end{document}. Traditionally, these algorithms were implemented in distributed systems with up to ten participating processes. Nowadays, they are implemented in distributed systems that involve hundreds or thousands of processes. To make sure that these algorithms are still correct for that scale, it is imperative to verify them for all possible values of the parameters.

Part 6: Large-Scale Decentralised Systems; International audience; Gossip protocols form the basis of many smart collective adaptive systems. They are a class of fully decentralised, simple but robust protocols for the distribution of information throughout large scale networks with hundreds or thousands of nodes. Mean field analysis methods have made it possible to approximate and analyse performance aspects of such large scale protocols in an efficient way that is independent of the number of nodes in the network. Taking the gossip shuffle protocol as a benchmark, we evaluate a recently developed refined mean field approach. We illustrate the gain in accuracy this can provide for the analysis of medium size models analysing two key performance measures: replication and coverage. We also show that refined mean field analysis requires special attention to correctly capture the coordination aspects of the gossip shuffle protocol.

Part 3: Message-Based Communication; International audience; We propose a model-driven approach based on formal data-driven choreographies to model message-passing applications. We apply our approach to the threat intelligence exchange (TIE) services provided by McAfee through the OpenDXL industrial platform. We advocate a chain of model transformations that (i) devises a visual presentation of communication protocols, (ii) formalises a global specification from the visual presentation that captures the data flow among services, (iii) enables the automatic derivation of specifications for the single components, and (iv) enables the analysis of software implementations.

Part 1: Tutorials; International audience; Choreographic development envisages distributed coordination as determined by interactions that allow peer components to harmoniously realise a given task. Unlike in orchestration-based coordination, there is no special component directing the execution. Recently, choreographic approaches have become popular in industrial contexts where reliability and scalability are crucial factors. This tutorial reviews some recent ideas to harness choreographic development of message-passing software. The key features of the approach are showcased within , a toolchain which allows software architects to identify defects of message-passing applications at early stages of development.

Part 3: Fault-Tolerance and Reproducibility; International audience; The performance and scalability of byzantine fault-tolerant (BFT) protocols for state machine replication (SMR) have recently come under scrutiny due to their application in the consensus mechanism of blockchain implementations. This led to a proliferation of proposals that provide different trade-offs that are not easily compared as, even if these are all based on message passing, multiple design and implementation factors besides the message exchange pattern differ between each of them. In this paper we focus on the impact of different combinations of cryptographic primitives and the message exchange pattern used to collect and disseminate votes, a key aspect for performance and scalability. By measuring this aspect in isolation and in a common framework, we characterise the design space and point out research directions for adaptive protocols that provide the best trade-off for each environment and workload combination.

Part 8: Modelling; International audience; We study formal modelling of architectures applied on parametric component-based systems consisting of an unknown number of instances of each component. Architecture modelling is achieved by means of logics. We introduce an extended propositional interaction logic and investigate its first-order level which serves as a formal language for the interactions of parametric systems. Our logic effectively describes the execution order of interactions which is a main feature in several important architectures. We state the decidability of equivalence, satisfiability, and validity of first-order extended interaction logic formulas, and provide several examples of formulas describing well-known architectures.

Part 3: Fault-Tolerance and Reproducibility; International audience; Low-code application development as proposed by the OutSystems Platform enables fast mobile and desktop application development and deployment. It hinges on visual development of the interface and business logic but also on easy integration with data stores and services while delivering robust applications that scale.Data integration increasingly means accessing a variety of NoSQL stores. Unfortunately, the diversity of data and processing models, that make them useful in the first place, is difficult to reconcile with the simplification of abstractions exposed to developers in a low-code platform. Moreover, NoSQL data stores also rely on a variety of general purpose and custom scripting languages as their main interfaces.In this paper we report on building a polyglot data access layer for the OutSystems Platform that uses SQL with optional embedded script snippets to bridge the gap between low-code and full access to NoSQL stores.

Part 8: Modelling; International audience; The execution of an event in a complex and distributed system where the dependencies vary during the evolution of the system can be represented in many ways, and one of them is to use Context-Dependent Event structures. Many kinds of event structures are related to various kind of Petri nets. The aim of this paper is to find the appropriate kind of Petri net that can be used to give an operational flavour to the dependencies represented in a Context/Dependent Event structure.

Part 3: eBusiness; International audience; This study aims to identify the conceptual structure and the thematic progress in e-Business, e-Services and e-Society and to elaborate on backbone/emerging topics in the field from 2001 to 2019. To address this objective, this paper employs hierarchical clustering, strategic diagrams and network analysis to construct the intellectual map of the I3E community and to visualize the thematic landscape in this field, using co-word analysis. Overall, a total of 835 papers from the proceedings of the e-Business, e-Services and e-Society (I3E) conference, and the respective 2574 author-assigned keywords, were included in the analyses. The results indicate that the community has significantly focused in areas like technology adoption models, Social Media, e-Government and business models; sentiment analysis and m-payments are peripheral themes, yet topics like cloud computing and Open Data are emerging. The analysis highlights the shift of the research interest throughout the past decades, and the rise of new topics, comprising evidence that the field is expanding and evolving. Limitations of the approach and future work plans conclude the paper.

Part 1: Block Chain; International audience; The purpose of this study is to explore whether the diffusion of cryptocurrencies represents a disruptive change and what is the potential magnitude of this change. To this end, we take disruptive innovation theory as our point of departure to scrutinize cryptocurrencies as an instance of socio-technical change. We employ Causal Layered Analysis to develop our four-layer analytical framework to conceptually examine the changes pertained by the diffusion of cryptocurrencies. We provide examples of changes company-level, industry-level as well as societal changes where cryptocurrencies have played a central role. On a company level, cryptocurrencies provide a cost-efficient means for cross-border money transfer and thus pose a significant threat to the existing intermediary-based business models. On an industry level, many central banks are experimenting with crypto- or digital currencies. On a societal level, cryptocurrencies play an important role in particularly when the traditional institutions and societal structures collapse. For example, in Venezuela’s recent political and economic crisis, cryptocurrencies contributed to the development of a parallel financial system when the bolivar practically lost its value. Our study provides an analytical framework to systematically evaluate the potential disruptive nature of cryptocurrencies as well as other blockchain-based technologies.

Part 3: eBusiness; International audience; Sustainable food security (Sfs) desires not only that people always have passage to ample and nutritious food, but also that this food be formed with minimum environmental impact. This research is aimed at developing a mobile application for marketing organic farm products with the functionality of automated geo-location services, preferred goods delivery services, easy access to different organic farm produce. The mobile user platform consists of the Presentation, Business, Data and Data storage which is a slight variation of the Model-View-Controller architecture. It also takes into deep awareness the configuration, security and communications aspect as these are the underlying factors for the robustness of mobile application. The Presentation Tier consists of the user interface and the logic used to navigate around the user interface meaningfully. It modifies and shows information into a human distinct pattern. The Business Logic tier is essentially efficient for information transfer between the user interface and the database of the project. The last layer of the three-tiered architecture is the Data Access tier, which is made up of the Database servers. The application was implemented in Java, SQLite (local) and PHP for the backend server and Amazon Web Services for cloud infrastructure. Farmers were engaged in cursory testing. Users find the application concept very interesting.

Part 2: Fourth Industrial Revolution; International audience; Smart manufacturing, Industry 4.0 and Smart Factory are phenomena regarded as a key necessity for Small, Medium and Micro Businesses (SMMEs) worldwide. Even though these 4th Industrial Revolution (4IR) phenomena are generally used interchangeably, this paper sought to identify how SMME readiness for smart manufacturing has been investigated through a systematic review. The systematic review was conducted through the lens of Nooteboom, and Tornatzky and Klein’s research on technological innovation in SMMEs based on Rogers’ diffusion of innovations theory. The findings reveal that there is little to no research on smart manufacturing in relation to SMMEs in low-income countries particularly the African continent. The results also show that smart manufacturing is still an emergent phenomenon with disparate definitional challenges. These definitional challenges make the adoption of smart manufacturing innovations a challenge in resource-constrained contexts; but similarly present an opportunity for new definitions and theories in such contexts. The little research often treats SMMEs homogenously and as such misses their important heterogeneous (sector or industry specific) nature. Few research studies investigate SMME awareness (adequate knowledge) or make explicit the benefits (relative advantage) of smart manufacturing. Even fewer studies are explicit on the smart manufacturing technologies that are relevant for different SMME sectors. Smart manufacturing is identified as incompatible with SMME characteristics, that is SMMEs lack expertise/skills to comprehend the complexity of smart manufacturing, and also lack financial and human resources to implement smart manufacturing. Given that awareness, relative advantage, complexity and compatibility are critical barriers for SMME smart manufacturing readiness/adoption, there is a critical need for research to focus on these factors in particular for the context of resource constrained low-income country environments.

Part 2: Fourth Industrial Revolution; International audience; Inter-organisational relationships have been receiving increased attention in the context of the fourth industrial revolution. Technological advances in connectivity and digitisation are enabling vertically and horizontally integrated networks. The highly technical and dynamic environment in which various types of relationships exist requires a high level of cooperation and transparency between partners. The importance for Small and Medium Sized Organisations (SMEs) to develop and improve their relational capabilities is widely acknowledged. This research paper thus presents a tool and methodology that will enable SMEs to assess and improve these capabilities within the organisation. This paper aims to identify those requirements and practices described in the literature as conducive to sustainable relationship formation and development. A Relational Capability Maturity Model (RCMM) is proposed as a tool that will be able to address the requirements across the various functions of the organisation.

Part 4: Business Processes; International audience; Finding and comparing appropriate cloud services that best fit cloud service consumer requirements can be a complex, time-consuming and cost-intensive process, especially for small and medium-sized enterprises. Since there is no “one-fits-all” cloud service provider, companies face the challenge of selecting and combining services from different vendors to meet all their requirements. Therefore, this paper calls for the design of a cloud brokering framework that would enable faster and easier selection of cloud services by recommending appropriate services through a matchmaking system. Drawing on previously conducted studies and considering current issues and practical experiences both from provider and user perspectives, we propose a framework that would identify, rank and recommend cloud services from multiple modules and components to individual consumers. Furthermore, we contribute an early-stage design of a cloud broker framework that considers cloud-service consumers’ sourcing preferences while making new cloud-sourcing decisions and that can be used in the selection and adoption phase of implementing cloud services and/or as part of a multicloud strategy.

Part 3: eBusiness; International audience; Mobile phones have become an integral part of human lives with majority of people using them to access product and services for their day-to-day needs. However, mobile shopping adoption across the globe is not wide or fast as expected. In addition, the research is very scant in understanding various predictors of consumer adoption towards mobile shopping. The objective of this study is to identify most significant and non-significant predictors of consumer mobile shopping acceptance. Systematic review and weight analysis on 34 mobile shopping studies revealed researchers mostly employed TAM and UTAUT model as theoretical lens. This study found an interesting revelation that extrinsic motivation variables such as social influence and perceived usefulness determine consumer mobile shopping behavioral intention during early stages. However, in later stages intrinsic motivation variables such as satisfaction and trust play crucial role to emerge as best and promising predictor of consumer continuous intention respectively.

Part 2: Fault Tolerance and Big Data; International audience; To process big data, applications have been utilizing data processing libraries over the last years, which are however not optimized to work together for efficient processing. Intermediate Representations (IR) have been introduced for unifying essential functions into an abstract interface that supports cross-optimization between applications. Still, the efficiency of an IR depends on the architecture and the tools required for compilation and execution. In this paper, we present a first glance at a framework that provides an IR by creating containers with executable code from structures of data analytics functions, described in an input grammar. These containers process data in query lists and they can be executed either standalone or integrated with other big data analytics applications without the need to compile the entire framework.

Part 4: Modelling: Structures and Implementations; International audience; The Contract Automata Tool is an open-source tool for the specification, composition and synthesis of coordination of service contracts, including functionalities to deal with modalities and configurations. We discuss an implementation of the abstract parametric synthesis algorithm firstly introduced in our COORDINATION 2019 paper, comprehending most permissive controller, orchestration and choreography synthesis. The tool’s source code has been redesigned and refactored in Java 8, and we show the resulting gain in computational efficiency.

Part 1: Full Papers ; Part of the book sub series: Programming and Software Engineering (LNPSE); International audience; For the past 50 years, temporal constraints have been a key driver in the development of critical systems, as ensuring their safety requires their behaviour to meet stringent temporal requirements. A well established and promising approach to express and verify such temporal constraints is to rely on formal modelling languages. One such language is CCSL, first introduced as part of the MARTE UML profile, which allows the developer, through entities called clocks, to abstract any system into events on which constraints can be expressed, and then assessed using TimeSquare, a tool which implements its operational semantics. By nature, CCSL handles horizontal separation (component based design at one step in the system development) of concerns through the notion of clocks, but does not yet take into account the other major separation of concerns used in modern system development: vertical separation, also called refinement in the literature (relations between the various steps of the system development). This paper proposes an approach to extend CCSL with a notion of refinement in order to handle temporal models relying on both vertical and horizontal parts. Our proposal relies on the notion of multi-layered time to provide two new CCSL relations expressing two different yet complementary notions of refinement. Their integration with the other CCSL constructs is discussed and their use is illustrated while the relevance and future impacts of this extended version of CCSL is detailed.

Part 2: Communications: Types and Implemenations; International audience; Global types are at the core of communication based programming. They allow a high level specification of protocols involving many participants and enforce good safety and liveness properties, such as absence of deadlock, locked participants and orphan messages. In this paper, we describe an implementation of a novel formalism of global types for sessions with asynchronous communications in co-logic programming, where we use coinduction to properly handle the coinductive syntax of global types and processes. We also define a simple query language to write sessions and global types, providing primitives for type checking.

A k-anonymous broadcast can be implemented using a small group of dining cryptographers to first share the message, followed by a flooding phase started by group members. Members have little incentive to forward the message in a timely manner, as forwarding incurs costs, or they may even profit from keeping the message. In worst case, this leaves the true originator as the only sender, rendering the dining-cryptographers phase useless and compromising their privacy. We present a novel approach using a modified dining-cryptographers protocol to distributed shares of an (n,k)-Shamir's secret sharing scheme. Finally, all group members broadcast their received share through the network, allowing any recipient of k shares to reconstruct the message, enforcing anonymity. If less than k group members broadcast their shares, the message cannot be decoded thus preventing privacy breaches for the originator. Our system provides (n-|attackers|)-anonymity for up to k-1 attackers and has little performance impact on dissemination. We show these results in a security analysis and performance evaluation based on a proof-of-concept prototype. Throughput rates between 10 and 100 kB/s are enough for many real applications with high privacy requirements, e.g., financial blockchain system., 16 pages, 5 figures

Part 4: Modelling: Structures and Implementations; International audience; Coordination scenarios have high demands on concurrency and interaction. However, these are typical sources for flaws in both design and implementation. A modeling approach enables reasoning about distributed algorithms and finding deficiencies right from the beginning. The Peer Model has been introduced as a modeling tool for distribution, concurrency and blackboard-based collaboration and coordination, relying on known foundations like tuple spaces, Petri Nets and Actor Model. A runtime system exists that serves Java developers for prototyping, but still a feasible tool-chain was missing, like for most academic systems.This paper presents a practical new tool-chain for the Peer Model consisting of a graphical modelling tool, building on a drawing program that exports XML. A translator parses the XML and translates it into a newly developed domain specific language that is the basis for code generation. One target is a new, formal automaton-based runtime written in the Go programming language. It allows systematic simulation runs of user models. The demo shows a peer competition scenario, where several players play a game, a global state holds the players’ scores, and in addition each peer maintains a decentralized state. Before taking a move in the game, a peer asserts its current local state to be the same like the global one. If this is the case, it carries out its action and distributes the information about it to all other players for further verification. The scenario captures core coordination mechanisms found in blockchain systems.

Part 3: Distributed Algorithms; International audience; Federated learning is a novel research area of AI technology that focus on distributed training and privacy preservation. Current federated optimization algorithms face serious challenge in the aspects of speed and accuracy, especially in non-i.i.d scenario. In this work, we propose UCBFed, a federated optimization algorithm that uses the Upper Confidence Bound (UCB) method to heuristically select participating clients in each round’s optimization process. We evaluate our algorithm in multiple federated distributed datasets. Comparing to most widely-used FedAvg and FedOpt, the UCBFed we proposed is superior in both the final accuracy and communication efficiency.

International audience; Session types are becoming popular and have been integrated in several mainstream programming languages. Nevertheless, while many programming languages consider asynchronous fifo channel communication, the notion of subtyping used in session type implementations is the one defined by Gay and Hole for synchronous communication. This might be because there are several notions of asynchronous session subtyping, these notions are usually undecidable, and only recently sound (but not complete) algorithmic characterizations for these subtypings have been proposed. But the fact that the definition of asynchronous session subtyping and the theory behind related algorithms are not easily accessible to non-experts may also prevent further integration. The aim of this paper, and of the tool presented therein, is to make the growing body of knowledge about asynchronous session subtyping more accessible, thus promoting its integration in practical applications of session types.

Docker images are used to distribute and deploy cloud-native applications in containerised form. A container engine runs them with separated privileges according to namespaces. Recent studies have investigated security vulnerabilities and runtime characteristics of Docker images. In contrast, little is known about the extent of hardware-dependent features in them such as processor-specific trusted execution environments, graphics acceleration or extension boards. This problem can be generalised to missing knowledge about the extent of any hardware-bound instructions within the images that may require elevated privileges. We first conduct a systematic one-year evolution analysis of a sample of Docker images concerning their use of hardware-specific features. To improve the state of technology, we contribute novel tools to manage such images. Our heuristic hardware dependency detector and a hardware-aware Docker executor give early warnings upon missing dependencies instead of leading to silent or untimely failures. Our dataset and tools are released to the research community., 21st International Conference on Distributed Applications and Interoperable Systems

Edge devices are increasingly in charge of storing privacy-sensitive data, in particular implantables, wearables, and nearables can potentially collect and process high-resolution vital signs 24/7. Storing and performing computations over such data in a privacy-preserving fashion is of paramount importance. We present KEVLAR-TZ, an application-level trusted cache designed to leverage ARM TrustZone, a popular trusted execution environment available in consumer-grade devices. To facilitate the integration with existing systems and IoT devices and protocols, KEVLAR-TZ exposes a REST-based interface with connection endpoints inside the TrustZone enclave. Furthermore, it exploits the on-device secure persistent storage to guarantee durability of data across reboots. We fully implemented KEVLAR-TZ on top of the OP-TEE framework, and experimentally evaluated its performance. Our results showcase performance trade-offs, for instance in terms of throughput and latency, for various workloads, and we believe our results can be useful for practitioners and in general developers of systems for TrustZone. KEVLAR-TZ is available as open-source at https://github.com/mqttz/kevlar-tz/., 15 pages, 21st International Conference on Distributed Applications and Interoperable Systems (DAIS21)

Part 2: Communications: Types and Implemenations; International audience; Rust is a popular systems language focused on performance and reliability, with an emphasis on providing “fearless concurrency”. Message passing has become a widely-used pattern by Rust developers although the potential for communication errors leaves developing safe and concurrent applications an unsolved challenge. In this ongoing work, we use multiparty session types to provide safety guarantees such as deadlock-freedom by coordinating message-passing processes. In contrast to previous contributions [20–22], our implementation targets asynchronous applications using / code in Rust. Specifically, we incorporate asynchronous subtyping theory, which allows program optimisation through reordering input and output actions. We evaluate our ideas by developing several representative use cases from the literature and by taking microbenchmarks. We discuss our plans to support full API generation integrating asynchronous optimisations.

Session types denote message protocols between concurrent processes, allowing a type-safe expression of inter-process communication. Although previous work demonstrate a well-defined notion of subtyping where processes have different perceptions of the protocol, these formulations were limited to linear session types where each channel of communication has a unique provider and client. In this paper, we extend subtyping to shared session types where channels can now have multiple clients instead of a single client. We demonstrate that this generalization can statically capture protocol requirements that span multiple phases of interactions of a client with a shared service provider, something not possible in prior proposals. Moreover, the phases are manifest in the type of the client., Extended and revised version of a paper presented at COORDINATION 2021

Part 5: Microservices; International audience; Field-based coordination is a model for expressing the coordination logic of large-scale adaptive systems, composing functional blocks from a global perspective. As for any coordination model, a proper toolchain must be developed to support its adoption across all development phases. Under this point of view, the ScaFi toolkit provides a coordination language (field calculus) as a DSL internal in the Scala language, a library of reusable building blocks, and an infrastructure for simulation of distributed deployments. In this work, we enrich such a toolchain by introducing ScaFi-Web, a web-based application allowing in-browser editing, execution, and visualisation of ScaFi programs. ScaFi-Web facilitates access to the ScaFi coordination technology by flattening the learning curve and simplifying configuration and requirements, thus promoting agile prototyping of field-based coordination specifications. In turn, this opens the door to easier demonstrations and experimentation, and also constitutes a stepping stone towards monitoring and control of simulated/deployed systems.

Multiparty sessions with asynchronous communications and global types play an important role for the modelling of interaction protocols in distributed systems. In designing such calculi the aim is to enforce, by typing, good properties for all participants, maximising, at the same time, the accepted behaviours. Our type system improves the state-of-the-art by typing all asynchronous sessions and preserving the key properties of Subject Reduction, Session Fidelity and Progress when some well-formedness conditions are satisfied. The type system comes together with a sound and complete type inference algorithm. The well-formedness conditions are undecidable, but an algorithm checking an expressive restriction of them recovers the effectiveness of typing.

Part 1: Tutorial; International audience; Actor languages decouple communication from synchronization, which makes them suitable for distributed and scalable applications with flexible synchronization patterns, but also facilitates analysis. ABS is a timed actor-based modeling language which supports cooperative scheduling and the specification of timing- and resource-sensitive behavior. Cooperative scheduling allows a process which is executing in an actor to be suspended while it is waiting for an event to occur, such that another process in the same actor can execute. Timed semantics allows the specification of the temporal behavior of the modeled system. Resource-sensitive behavior takes a supply and demand perspective of execution, relating cost centers which provision resources to processes which require them. These modeling concepts have been used in ABS to model cloud computing, e.g., data-processing applications running on the Hadoop platform and micro-services running on containers orchestrated by Kubernetes. In this tutorial, we present ABS and its execution environment, and discuss the use of cooperative scheduling and resources in modeling cyber-physical systems and applications deployed on virtualized infrastructure.

Part 5: Invited Paper; International audience; Many interesting systems in several disciplines can be modeled as networks of nodes that can store and exchange data: pervasive systems, edge computing scenarios, and even biological and bio-inspired systems. These systems feature inherent complexity, and often simulation is the preferred (and sometimes the only) way of investigating their behavior; this is true both in the design phase and in the verification and testing phase. In this tutorial paper, we provide a guide to the simulation of such systems by leveraging Alchemist, an existing research tool used in several works in the literature. We introduce its meta-model and its extensible architecture; we discuss reference examples of increasing complexity; and we finally show how to configure the tool to automatically execute multiple repetitions of simulations with different controlled variables, achieving reliable and reproducible results.

Part 3: Large-Scale Decentalised Systems; International audience; Automated market makers (AMMs) are one of the most prominent decentralized finance (DeFi) applications. They allow users to exchange units of different types of crypto-assets, without the need to find a counter-party. There are several implementations and models for AMMs, featuring a variety of sophisticated economic mechanisms. We present a theory of AMMs. The core of our theory is an abstract operational model of the interactions between users and AMMs, which can be concretised by instantiating the economic mechanisms. We exploit our theory to formally prove a set of fundamental properties of AMMs, characterizing both structural and economic aspects. We do this by abstracting from the actual economic mechanisms used in implementations and identifying sufficient conditions which ensure the relevant properties. Notably, we devise a general solution to the arbitrage problem, the main game-theoretic foundation behind the economic mechanisms of AMMs.

Part 2: Communications: Types and Implemenations; International audience; Detecting programming errors and vulnerabilities in software is increasingly important, and building tools that help developers with this task is a crucial area of investigation on which the industry depends. In object-oriented languages, one naturally defines stateful objects where the safe use of methods depends on their internal state; the correct use of objects according to their protocols is then enforced at compile-time by an analysis based on behavioral types.We present Java Typestate Checker (JATYC), a tool based on the Checker Framework that verifies Java programs with respect to typestates. These define the object’s states, the methods that can be called in each state, and the states resulting from the calls. The tool offers the following strong guarantees: sequences of method calls obey to object’s protocols; completion of objects’ protocols; detection of null-pointer exceptions; and control of the sharing of resources through access permissions.To the best of our knowledge, there are no research or industrial tools that offer all these features. In particular, the implementation of sharing control in a typestate-based tool seems to be novel, and has an important impact on programming flexibility, since, for most programs, the linear discipline imposed by behavioral types is too strict.Sharing of objects is enabled by means of an assertion language incorporating fractional permissions; to lift from programmers the burden of writing the assertions, JATYC infers all of these by building a constraint system and solving it with Z3, producing general assertions sufficient to accept the code, if these exist.

Part 3: Large-Scale Decentalised Systems; International audience; Business processes, data, and run-time control state are all key elements in the design of enterprise applications. However, the different layers for processes, data, and control are usually represented using different technologies that must be explicitly combined and kept in sync.We introduce ReGraDa, a process definition and programming language inspired by the declarative business process language Dynamic Condition Response Graphs and targeting the integrated description of business processes, data and run-time state as reactive graph data. ReGraDa processes compile directly to a data-centric graph-based system (neo4j/cypher), allowing for the database system to manage a process without the need for an external execution engine.The underlying graph structure allows for the definition of native data relations between data elements that subsumes the integrity guaranties of relational and the semi-structured data models. Graph relationships are also used to represent data-dependency and control-flow in the database.We present the reactive semantics of the language, a translation from ReGraDa to cypher, evaluate its performance, and briefly discuss future work and applications.

International audience; We develop a novel approach for run-time global adaptation of microservice applications, based on synthesis of architecture-level reconfiguration orchestrations. More precisely, we devise an algorithm for automatic reconfiguration that reaches a target system Maximum Computational Load by performing optimal deployment orchestrations. To conceive and simulate our approach, we introduce a novel integrated timed architectural modeling/execution language based on an extension of the actor-based object-oriented Abstract Behavioral Specification (ABS) language. In particular, we realize a timed extension of SmartDeployer, whose ABS code annotations make it possible to express architectural properties. Our Timed SmartDeployer tool fully integrates time features of ABS and architectural annotations by generating timed deployment orchestrations. We evaluate the applicability of our approach on a realistic microservice application taken from the literature: an Email Pipeline Processing System. We prove its effectiveness by simulating such an application and by comparing architecture-level reconfiguration with traditional local scaling techniques (which detect scaling needs and enact replications at the level of single microservices). Our comparison results show that our approach avoids cascading slowdowns and consequent increased message loss and latency, which affect traditional local scaling.

Part 3: Large-Scale Decentalised Systems; International audience; Space and time are key elements for many computer-based systems and often elevated to first-class abstractions. In tuple-based coordination, Linda primitives have been independently extended with space (with tuples and queries spanning spatial regions) or time information (mostly for tuple scoping). However, recent works in collective adaptive systems and aggregate computing show that space and time can naturally be considered as two intertwined facets of a common coordination abstraction for situated distributed systems. Accordingly, we introduce the Spatiotemporal Tuples model, a natural adaptation of Linda model for physically deployed large-scale networks. Unlike prior research, spatiotemporal properties – expressing where and when a tuple should range and has to be deposited/retrieved – naturally turn into specifications of collective adaptive processes, to be carried on in cooperation by the devices filling the computational environment, and sustaining tuple operations in a resilient way, possibly even in mobile and faulty environments. Additionally, the model promotes decentralised implementations where tuples actually reside where they are issued, which is good for supporting peer-to-peer and mobile ad-hoc networks as well as privacy. In this paper, we (i) present and formalise the Spatiotemporal Tuples model, based on the unifying notion of computational space-time structure, (ii) provide an implementation in the ScaFi aggregate computing framework, turning tuple operations into aggregate processes, and finally (iii) provide evaluation through simulation and a rescue case study.

International audience; Book Front Matter of LNCS 12717

Part 4: Modelling: Structures and Implementations; International audience; We identify the algebraic structure of the material histories generated by concurrent processes. Specifically, we extend existing categorical theories of resource convertibility to capture concurrent interaction. Our formalism admits an intuitive graphical presentation via string diagrams for proarrow equipments.

International audience; Book Front Matter of LNCS 12718

Part 3: Large-Scale Decentalised Systems; International audience; In microservices, Model-Driven Engineering (MDE) has emerged as a powerful methodology for architectural design. Independently, the community of programming languages has investigated new linguistic abstractions for effective microservice development. Here, we present the first preliminary study of how the two approaches can crosspollinate, taking the LEMMA framework and the Jolie programming language as respective representatives. We establish a common ground for comparing the two technologies in terms of metamodels, discuss practical enhancements that can be derived from the comparison, and present some directions for future work that arise from our new viewpoint.

Part 1: Cloud and Fog Computing; International audience; Multi-tenancy enables cost-effective SaaS through resource consolidation. Multiple customers, or tenants, are served by a single application instance, and isolation is enforced at the application level. Service load for different tenants can vary over time, requiring applications to scale in and out. A large class of SaaS providers operates legacy applications structured around a relational (SQL) database. These applications achieve tenant isolation through dedicated fields in their relational schema and are not designed to support scaling operations. We present a novel solution for scaling in or out such applications through the migration of a tenant’s data to new application and database instances. Our solution requires no change to the application and incurs no service downtime for non-migrated tenants. It leverages external tables and foreign data wrappers, as supported by major relational databases. We evaluate the approach using two multi-tenant applications: Iomad, an extension of the Moodle Learning Management System, and Camunda, a business process management platform. Our results show the usability of the method, minimally impacting performance for other tenants during migration and leading to increased service capacity after migration.

Part 5: Short Contributions; International audience; Highly configurable systems (HCSs), such as software product lines, have complex configuration spaces. Combinatorial Testing and Random Testing are the main approaches to testing of HCSs. In this paper, we empirically compare their strengths with respect to scalability and diversity of sampled configurations (i.e., tests). We choose Icpl and QuickSampler to respectively represent Combinatorial Testing and Random Testing. Experiments are conducted to evaluate the t-way coverage criterion of generated test suites for HCS benchmarks.

Part 4: Testing Methods and Automation; International audience; This paper demonstrates the applicability of state-of-the-art proof assistant tools to establish completeness properties of a test strategy and the correctness of its associated test generation algorithms, as well as to generate trustworthy executable code for these algorithms. To this end, a variation of an established test strategy is considered, which generates adaptive test cases based on a reference model represented as a possibly nondeterministic finite state machine (FSM). These test cases are sufficient to check whether the reduction conformance relation holds between the reference model and an implementation whose behaviour can also be represented by an FSM. Both the mechanical verification of this test strategy and the generation of a provably correct implementation are performed using the well-known Isabelle/HOL proof assistant.

Part 3: Testing Methods and Applications; International audience; There is a large need for effective and efficient testing processes and tools for mobile applications, due to their continuous evolution and to the sensitivity of their users to failures. Industries and researchers focus their effort to the realization of effective fully automatic testing techniques for mobile applications. Many of the proposed testing techniques lack in efficiency because their algorithms cannot be executed in parallel. In particular, Active Learning testing techniques usually relay on sequential algorithms.In this paper we propose a Active Learning technique for the fully automatic exploration and testing of Android applications, that parallelizes and improves a general algorithm proposed in the literature. The novel parallel algorithm has been implemented in the context of a prototype tool exploiting a component-based architecture, and has been experimentally evaluated on 3 open source Android applications by varying different deployment configurations.The measured results have shown the feasibility of the proposed technique and an average saving in testing time between 33% (deploying two testing resources) and about 80% (deploying 12 testing resources).