An important and recurring security scenario involves the need to carry out trusted computations in the context of untrusted environments. It is shown how a tamper-resistant interpreter for a programming language-currently Lisp 1.5-combined with the use of a secure coprocessor can address this problem. This solution executes the interpreter on the secure coprocessor while the code and data of the program reside in the larger memory of an associated untrusted host. This allows the coprocessor to utilize the host's memory without fear of tampering even by a hostile host. This approach has several advantages including ease of use, and the ability to provide tamper-resistance for any program that can be constructed using the language. The language approach enabled the development of two novel mechanisms for implementing tamper resistance. These mechanisms provide alternatives to pure Merkle hash trees. Simulated relative performance of the various mechanisms is provided and shows the relative merits of each mechanism.

Initial deployment and subsequent dynamic reconfiguration of a software system is difficult because of the interplay of many interdependent factors, including cost, time, application state, and system resources. As the size and complexity of software systems increases, procedures (manual or automated) that assume a static software architecture and environment are becoming untenable. We have developed a novel technique for carrying out the deployment and reconfiguration planning processes that leverages recent advances in the field of temporal planning. We describe a tool called Planit, which manages the deployment and reconfiguration of a software system utilizing a temporal planner. Given a model of the structure of a software system, the network upon which the system should be hosted, and a goal configuration, Planit will use the temporal planner to devise possible deployments of the system. Given information about changes in the state of the system, network and a revised goal, Planit will use the temporal planner to devise possible reconfigurations of the system. We present the results of a case study in which Planit is applied to a system consisting of various components that communicate across an application-level overlay network.

Even though the number and variety of available configuration management systems has grown rapidly in the past few years, the need for new configuration management systems still remains. Driving this need are the emergence of situations requiring highly specialized solutions, the demand for management of artifacts other than traditional source code and the exploration of entirely new research questions in configuration management. Complicating the picture is the trend toward organizational structures that involve personnel working at physically separate sites. We have developed a testbed to support the rapid development of configuration management systems. The testbed separates configuration management repositories (i.e., the stores for versions of artifacts) from configuration management policies (i.e., the procedures, according to which the versions are manipulated) by providing a generic model of a distributed repository and an associated programmatic interface. Specific configuration management policies are programmed as unique extensions to the generic interface, while the underlying distributed repository is reused across different policies. The authors describe the repository model and its interface and present their experience in using a prototype of the testbed, called NUCM, to implement a variety of configuration management systems.

Configuring and deploying a large software system is complicated when the system is composed of components and when there are numerous possible configurations for the system. In such a scenario, it is difficult for end users to specify and install an appropriate configuration for their specific environment. Defining all valid configurations of a software system is challenging, and can be addressed through a concise specification that can generate all of the possible configurations. The Deployable Software Description (DSD) part of the University of Colorado Software Dock project, is one such specification format. But using the DSD runs the risk that the set of generated configurations includes some that are invalid with respect to constraints defined independently of the DSD. The paper describes a framework to support the analysis of DSD specifications to help developers detect potentially invalid configurations. This analysis assumes that the system components are annotated with properties, and an analysis tool is provided that takes a specific configuration and analyzes it for conflicts with respect to some set of constraints. Using the DSD, we can enumerate and analyze configurations to verify their validity. The results can be used to modify the DSD to avoid future generation of invalid configurations.

Software deployment is an evolving collection of interrelated processes such as release, install, adapt, reconfigure, update, activate, deactivate, remove, and retire. The connectivity of large networks, such as the Internet, is affecting how software deployment is being performed. To take full advantage of this connectivity, new software deployment technologies must be introduced in order to support these processes. The Software Dock research project is creating a distributed, agent-based deployment framework to support the ongoing cooperation and negotiation among software producers themselves and among software producers and software consumers. This deployment framework is enabled by the use of a standardized semantic schema for describing software systems, called the Deployable Software Description (DSD) format. The Software Dock employs agents to traverse between software producers and consumers and to perform software deployment activities by interpreting the semantic descriptions of the software systems. The Software Dock infrastructure enables software producers to offer high-level deployment services that were previously not possible to their customers.

Software distribution is evolving from a physical media approach to one where it is practical and advantageous to leverage the connectivity of networks. Network distribution of software systems provides timeliness and continuity of evolution not possible with physical media distribution methods. To support network-based software distribution, companies and organizations such as Microsoft, Marimba, and the Desktop Management Task Force (DMTF) are strengthening their efforts to package software systems in a way that is conducive to network distribution and management. The result of these efforts has led to the creation of software description languages and schema such as the Open Software Description format created by Microsoft and Marimba and the Management Information Format created by DMTF. While these efforts are steps in the right direction, they do not address deployment issues in a complete and systematic fashion. The contribution of this paper is to evaluate these leading software description technologies.

In the past, multiuser virtual environments have been developed as venues for entertainment and social interaction. Recent research focuses instead on their utility in carrying out work in the real world. This research has identified the importance of a mapping between the real and the virtual that permits the representation of real tasks in the virtual environment. We investigate the use of virtual environments—in particular, MUDs (Multi-User Dimensions)—in the domain of software process. In so doing, we define a mapping, ormetaphor, that permits the representation of software processes within a MUD. The system resulting from this mapping, calledPromo, permits the modeling and execution of software processes by geographically dispersed agents.

Few tools exist to address the post-development activities of configuring, releasing, installing, updating, reconfiguring, and even de-installing a software system. Certainly there is no unified approach for all of these activities, and none that can take full advantage of a wide-area network. The Software Dock represents an architecture for supporting post-development activities in such a setting. It is designed as a system of loosely-coupled, cooperating, distributed components that are bound together by a wide-area messaging and event system. In this paper we describe the Software Dock architecture and discuss the use of a prototype in deploying a complex system.

Software process programming is the coding of software processes in executable programming languages. Process programming offers many potential benefits, but their realization has been hampered by a lack of experience in the design and use of process programming languages. APPL/A is a prototype software process programming language developed to help gain this experience. It is intended for the coding of programs to represent and support software processes including process, product, and project management. APPL/A is defined as an extension to Ada, to which it adds persistent programmable relations, concurrent triggers on relation operations (for reactive control), optionally and dynamically enforceable predicates on relations (which may serve as constraints), and composite statements that provide alternative combinations of serializability, atomicity, and consistency enforcement (for programming high-level transactions). APPL/A has been used to code engineering-oriented applications, like requirements specification and design, as well as management-related activities, such as personnel assignment, task scheduling, and project monitoring. APPL/A has also enabled us to experiment with process program design techniques and architectures, including process state reification, intermittent (or persistent) processes, reflexive and metaprocesses, and multiple-process systems. Our ability to address a wide range of software processes and process characteristics indicates that the APPL/A constructs represent important and general capabilities for software process programming.— Authors' Abstract

An approach to the coordinated sharing and interchange of computerized information is described emphasizing partial, controlled sharing among autonomous databases. Office information systems provide a particularly appropriate context for this type of information sharing and exchange. A federated database architecture is described in which a collection of independent database systems are united into a loosely coupled federation in order to share and exchange information. A federation consists of components (of which there may be any number) and a single federal dictionary. The components represent individual users, applications, workstations, or other components in an office information system. The federal dictionary is a specialized component that maintains the topology of the federation and oversees the entry of new components. Each component in the federation controls its interactions with other components by means of an export schema and an import schema. The export schema specifies the information that a component will share with other components, while the import schema specifies the nonlocal information that a component wishes to manipulate. The federated architecture provides mechanisms for sharing data, for sharing transactions (via message types) for combining information from several components, and for coordinating activities among autonomous components (via negotiation). A prototype implementation of the federated database mechanism is currently operational on an experimental basis.