Roger Villemaire

Runtime Enforcement of Web Service Message Contracts with Data

An increasing number of popular SOAP web services exhibit a stateful behavior, where a successful interaction is determined as much by the correct format of messages as by the sequence in which they are exchanged with a client. The set of such constraints forms a “message contract” that needs to be enforced on both sides of the transaction; it often includes constraints referring to actual data elements inside messages. We present an algorithm for the runtime monitoring of such message contracts with data parameterization. Their properties are expressed in LTL-FO+, an extension of Linear Temporal Logic that allows first-order quantification over the data inside a trace of XML messages. An implementation of this algorithm can transparently enforce an LTL-FO+ specification using a small and invisible Java applet. Violations of the specification are reported on-the-fly and prevent erroneous or out-of-sequence XML messages from being exchanged. Experiments on commercial web services from Amazon.com and Google indicate that LTL-FO+ is an appropriate language for expressing their message contracts, and that its processing overhead on sample traces is acceptable both for client-side and server-side enforcement architectures.

Presburger arithmetic and recognizability of sets of natural numbers by automata: New proofs of Cobham's and Semenov's theorems

Abstract Let N be the set of nonnegative integers. We show the two following facts about Presburgers arithmetic: 1. 1. Let L ⊆ N . If L is not definable in 〈 N , +〉 then there is an L′ ⊆ N definable in 〈 N ,+,L〉 , such that there is no bound on the distance between two consecutive elements of L′. (Actually we give in Theorem 3.7 two explicit sets one of which can be chosen to be L′) and 2. 2. L ⊆ N n is definable in 〈 N , +〉 if and only if every subset of N which is definable in 〈 N , +, L〉 is definable in 〈 N , +〉. (Theorem 5.1) These two Theorems are of independent interest but we will get from them new proofs of Cobhams and Semenovs Theorems (Cobhams Theorem being the case n = 1 of Semenovs Theorem); Semenovs Theorem is: Let k and l be multiplicatively independent (i.e have no nondashtrivial common power). If L ⊆ N n is definable in 〈 N , +, V k 〉 and in 〈 N , +,V l 〉 then L is recognizable (i.e definable in 〈 N , +〉). Here Vm is the function which sends a nonzero natural number to the greatest power of m dividing it.

Runtime Verification of Web Service Interface Contracts

Asynchronous JavaScript and XML (Ajax) is a collection of technologies used to develop rich and interactive Web applications. A typical Ajax client runs locally in the users Web browser and refreshes its interface on the fly in response to user input. Using this method with the AWS-ECS let us automatically generate test sequences and detect two deviations of their service implementation with respect to the online documentation provided, in less than three minutes of testing. We also provided a framework that allows the runtime monitoring of both client and server contract constraints with minimal modification to an existing Ajax application code. Experiments with the Amazon E-Commerce Service demonstrate the advantages of using a model-based approach for the runtime testing and monitoring of Web applications.

Browser-Based Enforcement of Interface Contracts in Web Applications with BeepBeep

BeepBeep is a lightweight runtime monitor for Ajax web applications. Interface specifications are expressed internally in an extension of LTL with first-order quantification; they can be transparently enforced on the client side using a small and invisible Java applet. Violations of the specification are reported on-the-fly and prevent erroneous or out-of-sequence XML messages from reaching the server.

Runtime monitoring of web service choreographies using streaming XML

A wide range of web service choreography constraints on the content and sequentiality of messages can be translated into Linear Temporal Logic (LTL). Although they can be checked statically on abstractions of actual services, it is desirable that violations of these specifications be also detected at runtime. In this paper, we show that, given a suitable translation of LTL formulæ into XQuery expressions, such runtime monitoring of choreography constraints is possible by feeding the trace of messages to a streaming XQuery processor. The forward-only fragment of LTL is introduced; it represents the fragment of LTL supported by available streaming engines.

Self-configuration of network devices with configuration logic

Autonomic networking is an emerging approach to the management of computer networks that aims at developing self-governed devices. Among the main issues of autonomic systems is the question of self-configuration. In this paper, we describe a method for discovering and self-generating the configuration of a network device in order to dynamically push a new service into a network. On each configuration, several rules representing the semantics of the services are expressed in a logical formalism called Configuration Logic. From these rules, we show how to use traditional satisfiability methods to automatically generate or modify the configuration of a device with respect to the configuration of its neighbours. We illustrate our case with an example of a switch that automatically discovers its VLAN configuration when connected to an existing network. The results presented here have been implemented into the configuration management tool ValidMaker.

Firewall anomaly detection with a model checker for visibility logic

An anomaly in a firewall is a relationship between two of its rules that may hint at a possible misconfiguration of its filter. One notable limitation of existing solutions for firewall analysis is that they provide algorithms tailored for the verification of specific anomalies. We introduce a modal logic, called Visibility Logic (VL), which can be used to express arbitrary patterns between rules inside a firewall. A model checker allows one to verify any formula expressed in visibility logic, of which traditional anomalies are merely particular instances, with running times of under one second for 1,500 rules.

Joining k- and l-Recognizable Sets of Natural Numbers

We show that the first order theory of , where V r : IN{0} → IN is the function which sends x to V r (x), the greatest power of r which divides x and k, l are multiplicatively independent (i.e. they have no common power) is undecidable. Actually we prove that multiplication is definable in . This shows that the theorem of Buchi cannot be generalized to a class containing all k- and all l-recognizable sets.

Automated Validation of Service Configuration on Network Devices

Due to the significant development of network services in the past few years, their validation has become increasingly difficult. The advent of novel approaches to the issue of validation is therefore vital for keeping services manageable, safe, and reliable. We present a model for the validation of service configurations on network devices. A service configuration is modelled by a tree structure, and its properties are described by validation rules expressed in terms of these tree elements. By using an existing logical formalism called TQL, we have succeeded in expressing complex dependencies between parameters, and in automatically checking these dependencies against real-world network descriptions in feasible time.

Configuration logic: a multi-site modal logic

We introduce a logical formalism for describing properties of configurations of computing systems. This logic of trees allows quantification on node labels, which are modalities containing variables. We explain the motivation behind our formalism and give both a classical semantics and a new equivalent one based on partial functions on variables.