Conventional online social networks (OSNs) are implemented in a centralized manner. Although centralization is a convenient way for implementing OSNs, it has several well known drawbacks. Chief among them are the risks they pose to the security and privacy of the information maintained by the OSN;

Dependability of heterogeneous distributed systems is an important issue. Coordination failures may occur even if the given coordination protocol is adhered to by all participants. The fault tolerance (FT) properties of systems are difficult to achieve, especially at application level. What is commo

Under service oriented architecture (SOA), a system- such as an enterprise-consists of multiple heterogeneous servers (service providers), which may be distributed over a wide area of network, and may be managed under different administrative domains. One of the goals of this work is to enable the system as a whole (i.e., the enterprise) to impose global constraints on the interactive behavior of the various heterogeneous servers. Moreover, individual servers typically make explicit or implicit commitments to their clients regarding the services they provide. Such commitments may include such things as privacy policies, and SLAs, as well as run-time promises to reserve certain merchandise for a specified time period. But the SOA methodology provides no guarantees to clients that the commitment made by a given server would actually be satisfied. Our second goal is to enforce certain types of commitments made by servers, provided that these commitments conform to the global constraints imposed by the system at large. Our technique employs LGI-based middleware to enforce stateful policies, and does not require any change of the conventional SOAP-based protocol, the UDDI server, or the programs employed by servers and their clients.

We are presenting a collaborative framework to enforce server commitments, and to regulate server interactive behavior in SOA systems. Trusted components collaborate to establish a network of enforcement components, one per server, to maintain proofs of what servers have committed with their clients

For a complex distributed system to be dependable, it must be continuously monitored, so that its failures and imperfections can be discovered and corrected in a timely manner. This work is concerned with the monitoring of large, open and heterogeneous systems, at their application level. Our object

The development of multiagent systems (MAS) is not a trivial task. In addition, with the advances in Internet technologies, MAS are undergoing a transition from closed to open architectures composed of a huge number of autonomous agents, which operate and move across different environments. In fact, openness introduces additional complexity to the system modeling, design and implementation. It also impacts on most quality attributes of MAS, including scalability, interoperability, reliability and adaptability. This paper brings together researchers and practitioners to discuss the current state and future direction of research in software engineering for open MAS. A particular interest is to understand those issues in the agent technology that make it difficult and/or improve the production of large open systems.

This paper maintains that for an access-control (AC) mechanism tosupport a wide range of policies, it is best to dispense with any built-insemantics for roles in the mechanism itself---be it the semantics of RBAC, orany other---leaving such semantics to be defined by particular policies. Inother words, an AC mechanism should be sensitive to roles, allowingspecific policies to take roles into account for their authorizationdecisions. But it should not be based on any particular interpretationof the structure of roles, or of their effect on access control. The validity of this assertion is demonstrated by showing that a mechanismcalled Law-governed interaction (LGI), which has no built-in concept of roles,can nevertheless support a wide range of policies that take roles intoaccount. These include RBAC itself, its various generalizations, as well asconcepts like budgetary controls, which seems to be quite inconsistent withRBAC. All such policies can be formulated, deployed, and enforced, via asingle scalable, and fully implemented LGI mechanism.

This paper proposes a flexible architecture for the creation of Internet auctions. It allows the custom definition of the auction parameters, and provides a decentralized control of the auction process. Auction policies are defined as laws in the Law Governed Interaction (LGI) paradigm. Each of these laws specifies not only the auction algorithm itself (e.g. open-cry, dutch, etc.) but also how to handle the other parameters usually involved in the online auctions, such as certification, auditioning, and treatment of complaints. LGI is used to enforce the rules established in the auction policy within the agents involved in the process. After the agents find out about the actions, they interact in a peer-to-peer communication protocol, reducing the role of the centralized auction room to an advertising registry, and taking profit of the distributed nature of the Internet to conduct the auction. The paper presents an example of an auction law, illustrating the use of the proposed architecture.

One of the most important challenges facing the builders of enterprise software is the reliable implementation of the policies that are supposed to govern the various communities operating within an enterprise. Such policies are widely considered fundamental to enterprise modeling, and their specification were the subject of several recent investigations. But specification of the policy that is to govern a given community is only the first step towards its implementation; the second, and more critical step is to ensure that all members of the community actually conform to the specified policy. The conventional approach to the implementation of a policy is to build it into all members of the community subject to it. But if the community in question is large and heterogeneous, and if its members are dispersed throughout a distributed enterprise, then such "manual" implementation of its policy would be too laborious and error-prone to be practical. Moreover, a policy implemented in this manual manner would be very unstable with respect to the evolution of the system, because it can be violated by a change in the code of any member of community subject to it. It is our thesis that the only reliable way for ensuring that an heterogeneous distributed community of software modules and people conforms to a given policy is for this policy to be strictly enforced. A mechanism for establishing enterprise communities by formally specifying their policies, and by having these policies enforced is the subject of the paper.

The conventional approach to distributed access control (AC) tends to be server-centric. Under this approach, each server establishes its own policy regarding the use of its resources and services by its clients. The choice of this policy, and its implementation, are generally considered the prerogative of each individual server. This approach to access control may be appropriate for many current client-server applications, where the server is an autonomous agent, in complete charge of its resources. It is not suitable for the growing class of applications where a group of servers, and sometimes their clients, belong to a single enterprise, and are subject to the enterprise-wide policy governing them all. One may not be able to entrust such an enterprise-wide policy to the individual servers, for two reasons: first, it is hard to ensure that an heterogeneous set of servers implement exactly the same policy. Second, as demonstrate, an AC policy can have aspects that cannot, in principle, be implemented by servers alone. As argued in a previous paper (Minsky, 2000), what is needed in this situation is a concept of communal policy that governs the interaction between the members of a distributed community of agents involved in some common activity along with a mechanism that provides for the explicit formulation of such policies, and for their scalable enforcement. We focus on the communal treatment of expiration and revocation of the digital certificates used for the authentication of the identity and roles of members of the community.

Current Web technologies use access control lists (ACLs) for enforcing regulations and practices governing businesses today. Having the policy hard-coded into ACLs causes management and security problems which have sofar prevented intranets from achieving their full potential. This paper is about a concrete design of a mechanism that supports policies for regulating access to information via corporate intranet. This mechanism makes a strict separation between the formal statement of a policy, and its enforcement, the latter being carried out by generic policy engines. The proposed mechanism is easy to deploy, requiring no modifications of current Web servers. We provide some preliminary performance results that show that the mechanism is quite affordable, even in its present, experimental stage.

The need for multiple views of an object is often encountered in software practice. This paper presents our experience in addressing this need under a software architecture known as the law-governed architecture. We introduce the notion of a surrogate object which allows an object to appear different and behave differently when used from different parts of a system. This concept requires some minor modifications to the classical inheritance-based object-oriented systems, mostly involving a judicious use of delegation. A concrete implementation of surrogates under the law-governed architecture is described and some applications of surrogates are briefly discussed. Copyright © 2000 John Wiley & Sons, Ltd.

Software technology is undergoing a transition form monolithic systems, constructed according to a single overall design, into conglomerates of semiautonomous, heterogeneous, and independently designed subsystems, constructed and managed by different organizations, with little, if any, knowledge of each other. Among the problems inherent in such conglomerates, none is more serious than the difficulty to control the activities of the disparate agents operating in it, and the difficulty for such agents to coordinate their activities with each other. We argue that the nature of coordination and control required for such systems calls for the following principles to be satisfied: (1) coordination policies need to be enforced: (2) the enforcement needs to be decentralized; and (3) coordination policies need to be formulated explicitly—rather than being implicit in the code of the agents involved—and they should be enforced by means of a generic, broad spectrum mechanism; and (4) it should be possible to deploy and enforce a policy incrementally, without exacting any cost from agents and activities not subject to it. We describe a mechansim called law-governed interaction (LGI), currently implemented by the Moses toolkit, which has been designed to satisfy these principles. We show that LGI is at least as general as a conventional centralized coordination mechanism (CCM), and that it is more scalable, and generally more efficient, then CCM.

The paper introduces a mechanism for establishing policies for electronic commerce in a unified and secure manner. A commercial policy can be viewed as the embodiment of a contract between the principals involved in a certain type of commercial activity, and it may be concerned with such issues as: ensuring that a payment for services is refunded under specified circumstances; preventing certificates representing e-cash from being duplicated; ensuring that credit card numbers are used only for the transaction they are intended for; and, for certain socially sensitive transactions like the purchase of drugs, ensuring auditability by proper authorities. Our mechanism is based on a previously published concept of law governed interaction. It makes a strict separation between the formal statement of a policy, which we call a "law," and the enforcement of this law, which is carried out by a set of policy independent trusted controllers. A new policy under this scheme is created basically by formulating its law, and can be easily deployed throughout a distributed system. This mechanism enables a single agent to engage in several different activities, subject to disparate policies. Two example policies are discussed in detail: one ensures refundability of payment under certain circumstances; the other provides for payment by means of non copyable tickets.

In order to facilitate enforcement of protocols, an architecture for distributed systems is introduced under which all interactions between objects are governed by an explicit and strictly enforced set of rules, called the law of the system. This law is global in the sense that all the objects of the system are made to obey it, but the maintenance of the law and its enforcement are performed locally, at each object (or node). The term law is used to emphasized that it not only provides the specification of protocols, but actually governs the system by enforcing them. In other words, under this architecture a protocol can be established simply by writing it into the law of a system, without having to worry about the programs that drive the various objects that might populate that system. The law, then, is the enforced specification of protocols. It is shown that various familiar protocols can be established under this architecture. A technique for online distributed updating of the global law of a system is presented.>

We believe that the regime governing the patterns of sharing between objects, and of exchange of messages between them, should not be “hard-wired” into a programming language, but should be specifiable by the builders of a system to fit its particular requirements. This thesis has been the primary motivation behind our general concept of law-governed system, which serves as the foundation for this paper.

This paper is based on a new approach for dealing with large scale software systems. This approach is based on the concept of a Law-Governed System, which is a triple

The central idea behind this paper is that the discipline governing the exchange of messages between objects should be specifiable by the programmer in the form of an explicit law of the system. We show how, starting from a very primitive foundation, which presumes neither encapsulation nor inheritance, one can establish various forms of both, as well as other useful disciplines, simply by means of appropriate laws.

This paper presents a model that provides a single comprehensive mechanism to control the use, operation and evolution of database systems. This model unifies several concepts generally considered to be quite distinct. In particular, it minimizes the formal distinction between the users of the database, the programs embedded in it and even the administrators and the programmers maintaining it. Furthermore, under this model, the concepts of subschema and of program module are replaced with a single concept of frame, which serves as the locus of power and of activity in the system. Moreover, the proposed control mechanism is closed, in the sense that the process of establishing controls is itself controllable by the same mechanism. This can be used to formalize and control managerial policies about the use and evolution of database systems.

In a system based on authorization, the ability of a subject to operate on the system is a function of the privileges that he possesses.In this paper a mechanism, called Send-Receive, for the transport of such privileges, is introduced and studied.The control provided by this mechanism over the movement of privileges has two notable properties.--The control is selective, in the sense that it permits the creation of transport channels, which allow for the movement of only certain types of privileges and only between certain kinds of subjects.--The control is local, in the sense that every movement of privileges into and out of the domain of a given subject must be authorized by privileges already in his domain.The proposed transport mechanism is shown to allow the imposition of a local upper bound on the power of any given subject.This bound is independent of the rest of the system and can, therefore, be viewed as an intrinsic property of the subject.The ability to impose such bounds is considered essential for effective modularization of computer systems.In addition, the locality of our control has beneficial global effects on the flow of privileges.In particular, it helps remove the undesirable symmetry of transport, exhibited by the conventional Take-Grant mechanism.

This paper proposes a technique for what we call localization of power in computer systems, which can be viewed as a generalization of such linguistic disciplines as scope rules, strong typing and data-abstraction. Although the proposed technique is conceptually based on the theory of protection, it is presented as a rather simple extension of the package construct of the Ada language. This technique is expected to be beneficial for software engineering in several ways. In particular:• It facilitates reasoning about large scale systems, by allowing one to ignore most of the details of the system when reasoning about specific aspects of it.• It provides us with a generalization of the conventional concept of data-abstraction, by allowing the formation of several different abstractions for the same type of objects, and by supporting "interactions" between the abstractions of different types.• It allows us to provide parts of a system with a certain ability to control the activity of the rest of it.• It supports a broad spectrum of policies for the design and management of large scale, evolving systems.

One of the most critical and least understood aspects of protection is the exercise of control over the movement of rights between the subjects of a system. The conventional Take-Grant mechanism for exercising such control suffers from a puzzling and unfortunate limitation: it cannot enforce strictly unidirectional channels for the flow of rights. That is, if rights can be moved directly or indirectly from some subject p to another subject q, then one cannot prevent rights from flowing in the opposite direction, from q to p. This property limits the applicability of this mechanism and therefore that of any protection scheme utilizing it. We analyze the nature and ramifications of this limitation and demonstrate that its root cause is the fact that (under this mechanism) a right possessed by a sender suffices to authorize a movement of rights. We propose an alternative, "Take-Receive," model in which this limitation is eliminated, thus enabling the implementation of more useful protection disciplines. We prove this result by analyzing tl-e dynamic behavior of the proposed model.

In a system based on authorization, the power that a subject has to operate on the system is a function of the privileges which he possesses. In this paper we introduce a mechanism for the transport of such privileges. The control provided over the transport of privileges by this mechanism has two notable properties. The control is local, in the sense that every movement of privileges into the domain of a given subject, and out of it, must be authorized by privileges already in this domain. The control is selective, in the sense that it permits the creation of transport-channels which allow for the movement of only certain types of privileges. We show that the proposed, ao called, Send-Receive transport mechaniam supports local analysis which allows one to evaluate the potential power of a given subject, independently of the rest of the system. This property s considered essential for effective modularlzation.

The conventional concept of file is reexamined, and found to be unsatisfactory, both as a linguistic concept in a programming language and as a tool for data processing. A new file concept is proposed which unlike the conventional file attempts to simulate an intelligent archivist rather than a filing cabinet.