Sam Procter
email: sprocter@sei.edu.edu

Jerome Hugues
email: jjhugues@sei.edu.edu

Architecture-Supported Audit Processor

Keywords: Architecture-Supported Audit Processor: Interactive, Query-Driven Assurance Sam Procter, Jerome Interactive, Query-Driven Assurance Model-Based Engineering, System Safety, Hazard Analysis, Architecture Analysis and Design Language (AADL

come

INTRODUCTION

Safety-critical systems, i.e., those systems whose failure would result in death, injury, or unacceptable financial losses, are becoming increasingly sophisticated and software reliant [START_REF] Leveson | Safeware: System Safety and Computers[END_REF]. Developing confidence in the safe and reliable behavior of these systems requires efforts to assure them. The cost and time required for these assurance efforts is significant, and it has been argued that they are a bottleneck that prevents the rapid deployment of new and improved versions [START_REF] Espinoza | Challenges for an open and evolutionary approach to safety assurance and certification of safety-critical systems[END_REF]. Additionally, many assurance practices were not designed for modern systems and do not consider the impact of software on safety [START_REF] Leveson | Safeware: System Safety and Computers[END_REF], nor do they take advantage of model-based engineering techniques for the traceability of safety artifacts to system elements.

In this paper, we report on a tool-supported approach that addresses these shortcomings. We propose contextualizing assurance evidence in an environment that supports modern system development practices, and that explicitly links assurance evidence to safety argumentation. We present the Architecture-Supported Audit Processor (ASAP), an interactive tool which follows this strategy and supports common assurance activities in an architecture-centric, modelbased system development environment. The tool provides an assurance-specific view of a system that builds on previous work on merging modern safety analysis and system architecture [START_REF] Procter | A Development and Assurance Process for Medical Application Platform Apps[END_REF].

(1) Research Context We identify three research ideas from the safety and argumentation communities and discuss how they illuminate a path forward for nextgeneration hazard anlaysis. (2) SAFE Improvements We propose an approach for performing safety analysis that builds on the Systematic Analysis of Faults and Errors (SAFE) hazard analysis technique, which supports model-based, compositional safety argumentation. (3) Tool We describe the inputs, use cases, and outputs of the ASAP tool. In order to better explain the use of ASAP, we also orient its inputs and outputs in the process of a popular hazard analysis technique:

(4) Mapping to STPA We establish an example mapping to STPA [START_REF] Leveson | STPA Handbook[END_REF], a popular system-theoretic hazard analysis. Our mapping leverages system development tasks that are already performed in a typical development and presents safety information in an interactive, navigable format that can be queried. The remainder of the paper is organized as follows: Section 2 surveys three research topics which informed the design of ASAP. Section 3 describes background concepts, including languages, tooling, and theory this work directly builds on. Section 4 describes ASAP and its application to a small system. Section 5 presents related work. We discuss future work in Section 6 and conclude in Section 7.

Assurance evidence should be contextualized with explicit safety arguments

One of the challenges that makes assurance difficult is that the evidence produced by some assurance strategies may not be what is most relevant for actually determining the safety of a system. Take for example hazard analysis -a common way of assessing the safety of a system [START_REF] Ericson | Hazard Analysis Techniques for System Safety[END_REF]. Many hazard analyses consist of a series of steps to be performed at one or more stages in the system development lifecycle (e.g., preliminary design, detailed design, system test, etc.). The outcome of the analysis's steps is evidence that the system is either free from the types of safety issues that the technique is designed to detect or those issues have been mitigated to a point where residual risk is acceptable in light of the system's benefits. Some safety standards rely on this evidence for certification of a system's worthiness for a particular mission. Rushby, however, has argued that the claims and arguments which rely on that evidence-and upon which those standards are built-are sometimes based on reasoning that is left implicit [START_REF] Rushby | Formalism in Safety Cases[END_REF]. He continues by noting that while approaches based on standards as well as structured-argumentation like safety cases (also referred to more generally as assurance cases) both have their strengths and weaknesses, standardsbased approaches are "slow-moving and conservative. " This aligns, to some extent, with arguments made by Leveson, who writes that many hazard analyses and system safety standards are fundamentally outdated in their approach [START_REF] Leveson | Are you sure your software will not kill anyone?[END_REF]. In Leveson's view, a common error is to evaluate a system's reliability and use that as a stand-in for the system's safety. This approach, she continues, was more valid when safetycritical systems were largely hardware based: individual component failures were much more likely to be the ultimate cause of a system failure before the addition of software significantly increased the variety of component configurations [START_REF] Leveson | Safeware: System Safety and Computers[END_REF]. As a consequence, we undertake the following:

Our Goal: Assurance evidence should be contextualized, and that context should be explicit safety argumentation.

Assurance argumentation should be hierarchical

A second challenge to system assurance efforts stems from the competing goals of assurance documentation: it should be both easily understood yet completely accurate. System descriptions which are brief and abstract may be easily understood, but lack the technical precision and depth necessary to convey a complete understanding of a system. Complete and precise system descriptions, on the other hand, can take a significant amount of time to understand. This problem can be addressed, to an extent, through standardization: when assurance documentation is packaged in an expected format, familiarity with the standard can aide in understanding. But this leads to institutional inertia; i.e., Rushby's criticism of standards-based approaches as slow-moving [START_REF] Rushby | Formalism in Safety Cases[END_REF] or Espinoza et al. 's more pointed criticism that standards can be a barrier to innovation [START_REF] Espinoza | Challenges for an open and evolutionary approach to safety assurance and certification of safety-critical systems[END_REF]. We note that there is an interesting parallel here to another field where arguments are designed to convince human experts of their correctness: that of mathematical proof. In that domain, Lamport has argued for the utility of hierarchically structured, hypertext-enabled proofs [START_REF] Lamport | How to write a 21 st century proof[END_REF]. An initial, high-level argument can be presented at an abstract level, but the reader can expand portions that are unclear as necessary; in this way technology and argument structure can be used to address the competing goals simultaneously. Therefore, we also undertake the following:

Our Goal: Assurance evidence should be initially presented at a high level, but a viewer should be able to expand argumentation as desired.

Assurance evidence should be modular and composable

A third challenge stems from the discrepancy between the way systems are built (compositionally, as aggregates of components) and how safety argumentation is structured (monolithically). That is, because critical systems are designed for operation in particular environment, safety argumentation rarely composes as easily as software or hardware elements. This mismatch can lead to inconsistency in guidance for assuring seemingly related systems [START_REF] Hall | Model Integrated Decomposition and Assisted Specification (MIDAS)[END_REF] or system updates that are either postponed or avoided altogether to avoid the costs of (re)certification [START_REF] Espinoza | Challenges for an open and evolutionary approach to safety assurance and certification of safety-critical systems[END_REF]. However, fully compositional safety is an enduring challenge because it requires successfully pursuing one of two very challenging strategies:

(1) Anticipating the environment and role of a component: This was the approach taken by ISO 26262's concept of a "Safety Element out of Context" [START_REF]Road vehicles-Functional safety-Part 10[END_REF], ISO 14971's concept of "Intended Use" [START_REF]Medical devices-Application of risk management to medical devices[END_REF]), and SAFE's concept of a component's role [START_REF] Procter | A Development and Assurance Process for Medical Application Platform Apps[END_REF]. Recognizing that this goal may not be achievable, we nonetheless advocate its pursuit because progress towards it will still reduce the burden of creating assurance argumentation and speed the development of critical systems. Thus, our final objective is:

Our Goal: Assurance argumentation should be compositional.

This section introduces the background of the modeling technologies, example, and safety methodologies used in the paper.

AADL and OSATE

The Architecture Analysis and Design Language (AADL) is an internationally standardized architecture description language [START_REF]SAE AS-2C Architecture Analysis and Design Language Issuing Committee[END_REF]. AADL, which has both a textual and graphical syntax, is supported by the Open Source Architecture Tool Environment 1 (OSATE), which is a development environment based on the Eclipse IDE. System designers can use OSATE and AADL to model their system's software elements (e.g., thread, process, subprogram), hardware elements (e.g., processor, memory, bus), and the connections and bindings between them [START_REF] Feiler | Model-Based Engineering with AADL[END_REF]. Annexes extend the core language to address different, non-architectural aspects of system design, such as behavior or data modeling.

One such extension that this work relies heavily upon is the error modeling annex [START_REF]SAE Architecture Analysis and Design Language (AADL) Annex[END_REF], which includes mechanisms for specifying error types, which are errors that can be instantiated and propagated as tokens between components (similar to Wallace's Fault Propagation and Transformation Calculus [START_REF] Wallace | Modular Architectural Representation and Analysis of Fault Propagation and Transformation[END_REF]). For example, a sensor that produces a reading that may be higher than the actual value would be modeled as being a source propagation for tokens of the Value High error type. Error propagations represent the broadcast or reception of error tokens from/into components, typically via ports. This is used to represent a component producing erroneous output or receiving erroneous input, and can be used to trace the path that errors take through a system, e.g., a flawed sensor value is transformed by a software controller into an inappropriate command, which is transformed into a potentially unsafe actuation by a servo. The error modeling annex comes with a user-extensible library of error types, which is organized hierarchically into broad categories of error [START_REF] Procter | The AADL Error Library : An Operationalized Taxonomy of System Errors[END_REF]. The type system is quite flexible, and can be used by a modeler to represent arbitrary error conditions, potentially including, e.g., the state of the system's environment.

An Example System: PulseOx Forwarding

To illustrate the features of ASAP, we use an illustrative, open-source 2 example from the medical domain. In addition to a control loop with multiple inputs and outputs, it has a single safety concern, which is the failure to issue a necessary alert. It consists of the following elements:

• Hardware Devices -Represented as AADL devices -pulseOx: A pulse oximeter device, which measures the blood oxygen saturation (SpO 2 ) of a patient via a non-invasive fingerclip. Figure 1 shows the overall system in AADL's graphical syntax. This system is not complex, but has two aspects which make it ideal for demonstrating ASAP's features: it shows multiple control loops, i.e., circular paths through the system which involve both sensing and actuating; and some components (i.e., the processes) decompose cleanly into subcomponents (in this case a collection of communicating threads). Some of these components would be already be modeled as part of a normal system engineering process, while others (i.e., the humans) would typically need abstractions created specifically for safety analysis, e.g., to represent particular execution or interaction scenarios. Exactly which ones would need to be created for ASAP is impossible to specify without knowing what other analyses are being run on the system: modelers are typically encouraged to add only as much detail as required by the analyses they want to perform.

STPA and SAFE

The System Theoretic Process Analysis (STPA) is a hazard analysis that is designed to address many of the criticisms found with more reliability-oriented, hardware-focused analysis techniques [START_REF] Leveson | Engineering a Safer World: Systems Thinking Applied to Safety[END_REF][START_REF] Leveson | STPA Handbook[END_REF]. It has been adapted to work with AADL models without significant modification to the process [START_REF] Procter | An architecturally-integrated, systemsbased hazard analysis for medical applications[END_REF].

The Systematic Analysis of Faults and Errors (SAFE) is a hazard analysis technique that is heavily derivative of STPA, but contains a number of modifications, including a formal definition of hazard [START_REF] Procter | A Development and Assurance Process for Medical Application Platform Apps[END_REF]. This, along with additional specificity available with low-level architectural specifications such as AADL models, enables the new automation discussed in below. We discuss it, STPA, and SAFE in more depth as we explore ASAP in Section 4.

THE ARCHITECTURE-SUPPORTED AUDIT PROCESSOR

The Architecture-Supported Audit Processor (ASAP) is a plugin to OSATE that enables three "viewpoints" of a system. These viewpoints are diagrams and tables which are dynamically generated (i.e., in response to user input) and designed to support activities performed by system safety auditors. ASAP's viewpoints are generated from the system architecture as modeled in OSATE and supplementary safety information, entered by the system designer or analyst. The first viewpoint is somewhat abstract and presents high-level fundamental aspects of the system (or component's) safety. The second presents elements in their immediate context, and the third focuses narrowly on the causes (and potential compensations) of errors within a component. This progression from abstract to specific is typical of both model-based system design in AADL and hazard analysis techniques such as SAFE and STPA. This progression means that more shallow analyses can be performed using less time: a simpler model and less ASAP-specific annotations will produce less rich diagrams and information. Alternatively, different portions of the system can be modeled to different depths: a subcomponent whose behavior should be more deeply analyzed can be richly annotated while others are left essentially unspecified as "black boxes. " This lets designers focus on the portions of the system that are relevant to particular stakeholders without getting bogged down in creating sophisticated models solely for the purpose of enabling tool functionality.

Viewpoint 1: Fundamentals

In order to orient the analysis towards particular safety issues, STPA and derivative analyses such as SAFE make explicit the links between low-level faults and errors and highlevel safety concerns such as death or injury to a human. This is done by creating a fundamentals hierarchy, a structure that relates safety problems, and their solutions, to specific and general notions of accidents / losses. At the top of the hierarchy are accident levels, which are broad categories of harm that can be prioritized. A typical system might have death or injury to a human as the highest-ranked accident level, followed by damage to or destruction of mission equipment. Accidents are losses that can be caused by the system; any number of accidents can be linked to a single accident level. That is, there might be multiple specific accidents that would each result in harm to a human. A diagrammatic view of a fundamentals hierarchy is shown in Figure 2(a).

Linking concrete losses resulting from system failure (accidents) to the specific ways they occur (hazards) is a significant open challenge in designing architecturally-integrated safety analysis techniques. The difficulty comes in concisely specifying which system elements could be involved in causing a particular accident, and how the failure of those elements would cause the loss. Specifying the links between accidents and the system elements involved in their causation is necessary as these links form the context required to both understand the impact of system design choices and to construct coherent argumentation.

Hazards have a two-part definition in SAFE (which formalizes STPA's definition4 ) as a combination of one system and one environment state that will cause an accident; note that multiple hazards can lead to a single accident. Intuitively, this two-part definition results from the notion that certain system behaviors are rarely always unsafe, but rather only unsafe given a particular state of the environment. Leveson uses the example of a train: it is only unsafe for train's doors to be open while the train is moving [START_REF] Leveson | Engineering a Safer World: Systems Thinking Applied to Safety[END_REF]. In ASAP, hazards are modeled using the condition that causes them5 ; i.e., as the arrival of an error type at a component via its interface (e.g., a port), see Figure 2(b).

Figure 3 shows the fundamentals viewpoint in ASAP which supports STPA's first step. As shown by the lower portion, hazards contain a number of references to model elements including: a) Accident: The accident the hazard's occurrence would cause, b) Environment Element: The component whose state is the environmental "half" of the hazard, c) System Element: The component whose state is the system half of the hazard, d) Error Type: The AADL error type representing the system element's deviation from intended or acceptable behavior, and e) Hazardous Factor A human-readable name of what is being transmitted from the system element to the environment element 6 . Note that five of the nine elements linked to from the hazard (i.e., all those with icons other than ) are semantic objects in either the AADL or ASAP model, as opposed to plain text. By semantic objects, we mean that these refer to actual elements in the model, represented in OSATE as rich data structures with links to other elements. This helps keep the documentation synchronized with the model, and enables the query-driven behavior of the other viewpoints.

Viewpoint 2: Connected Neighbors

In hierarchically-organized system models of any useful size, it can be difficult to understand how a particular component fits into the larger system. Even the relatively simple PulseOx Forwarding system can be difficult to quickly understand: there are multiple cyclic control flow paths as well as multiple levels of abstraction; we use model slicing to reduce the complexity [START_REF] Thiagarajan | Awas: AADL Information Flow and Error Propagation Analysis Framework[END_REF]. AADL is purpose-built for hierarchically specifying system details.

STPA uses scoped control flow diagrams to present components in context in its second step, however, so we developed the Connected Neighbors viewpoint to show a given component, its immediate neighbors (i.e., those components that either produce input for the component or use its output), their neighbors, and any connections between the displayed components. AADL models contain all of this information already, the ASAP tooling extracts it automatically rather than requiring the diagrams to be constructed manually. Figure 4 shows an example of this viewpoint centering on the app-Logic component of the PulseOx Forwarding system. Note that some elements, such as the electronicHealthRecord or doctor, are too distant7 from the focused element, and thus are not displayed. Note that this is a subgraph of Figure 1 Our goal with this view is not to replace system-level views like what AADL presents, but rather to support analyst intuition and rapid understanding of a particular component's "point of view" of a system. For example, any input from the doctor that affects the application logic would first have to be understood by the clinician, which would affect the treatment administered to a patient, which would be detected by the PulseOx, at which point it would be received by the app-Logic. Put another way, the doctor's impact on the appLogic is mediated by three different system elements and thus may not be immediately relevant for gaining quick understanding, so the doctor does not appear as a neighbor of the appLogic in Figure 4.

Accident Level 1 Accident 1-1 Accident 1-2 Accident 1-l … Hazard 1-1-1 Hazard 1-1-2 … Hazard 1-1-m Constraint 1-1-1-1 Constraint 1-1-1-2 … Constraint 1-1-1-n C o

Viewpoint 3: Unsafe Control Actions

ASAP's third viewpoint displays information on how system hazards might come to occur, and how they could be prevented.

Preliminaries: Causes, Compensations, and Guidewords.

In any non-trivial system, there are a large number of ways that things can go wrong; in a safety-critical system these are documented as violations of the system's safety constraints. We refer to these violations as causes, i.e., ways that hazards (and associated losses) are caused. When thinking about a cause, the solution may or may not be apparent. If it is, a safety analyst should document it, we refer to these solutions (which may be partial, or conditioned on some other system behavior) as compensations. There is again a challenge in organizing and presenting a large amount of highly contextual information: a simple listing of causes and compensations is much harder to use than one organized, for example, around the system architecture or a taxonomy of system error types. These error types are equivalent to guidewords in hazard analysis techniques, which can be thought of as generic causes that are designed to prompt (i.e., guide) the thinking of analysts to consider various ways in which system elements might fail.

In addition to the manually-specified causes and compensations, however, a second form of loss scenario specification emerges naturally from a fully specified EMV2 model of a system. Given a specification of how an error can come about (i.e., an error source), be transformed by various components (error transformations), and its final result (error sink), analysts can gain a fairly clear description of how a failure might occur. Because this form of scenario specification is machine-readable, tooling can also interpret these loss scenarios for various purposes such as building fault trees or calculating failure rates. This view is not present in ASAP, but it is available from other safety analyses in OSATE [START_REF] Delange | Architecture Fault Modeling with the AADL Error-Model Annex[END_REF]. . STPA's third step involves identifying control actions that could be unsafe. Typically, this identification is performed as analysts fill in a table where each row is a control action and there are four columns, one for each way STPA suggests a control action could be unsafe [START_REF] Leveson | STPA Handbook[END_REF].

A Hierarchical Table

ASAP's version of this table is shown in Figure 5, note that there is an X for a connection (row) in the ItemTimingError (column). This denotes that documentation exists regarding the cause of a safety constraint violation involving the specified connection and the timing of messages being sent across it. A second table, from the same viewpoint can be generated that displays the same set of communication channels (i.e., rows) but the columns changed to show only the timing family of errors in the given component: here the full cause description (as well as optional compensation description) is shown. Identifying these scenarios where accidents / losses can occur is the fourth and final step of STPA.

The information required for these tables is pulled directly from both the system model (i.e., its error propagations), and the ASAP-specific fundamentals model, completing the deep integration of system model and hazard-analysis data. That is, there are two sources that are queried for each cell in the table: the "Fundamentals," which were created for ASAP's first viewpoint as well as the error propagations specified in the AADL model itself. If analyst-provided cause and / or compensation information is available, it is displayed; if only an error propagation indicates the presence of a problem, the text "Undocumented error propagation" is displayed instead.

Note that while the rows in the second, refined Unsafe Control Action table are the same as in the overview table, the columns can be errors from any error family, i.e., any of the abstract guidewords used in the model. While these column headings could be the guidewords from STPA, they could also be from AADL's Error Library (as in Figure 5) or any other set of guidewords / error collection. That is, while ASAP's Unsafe Control Actions viewpoint (i.e., the toplevel table shown in Figure 5 and the refined version of the table) are usable for STPA's third and fourth steps, it has two enhancements.

First, the rows are not restricted to just control actions, but instead include all connections in the selected system / component. This change was made because some problems can be associated with non-control actions (sensor readings can be incorrect, electrical or hydraulic power can be overor under-supplied, etc.) Recognizing and documenting these potential problems directly-instead of only when they manifest as unsafe control actions-is more concise. Additionally, distinguishing between a control action and sensor feedback is difficult to do consistently: it depends on the analyst's judgment and the component's role within the system.

Second, as ASAP is not directly tied to any particular hazard analysis process, the columns are generic: they are derived from the top-level error types used in the AADL model, rather than being unchangeable. An analyst could certainly choose to use STPA's set of guidewords, or they could use error types from the AADL Error Library, a custom set, or one derived from / aligned with a particular safety standard required by their company or the domain they are working in. Several such sets of system errors exist; Procter and Feiler have described AADL's Error Library and its relationship to guidewords used in hazard analyses [START_REF] Procter | The AADL Error Library : An Operationalized Taxonomy of System Errors[END_REF].

A Hierarchical

Taxonomy. Building a taxonomy of guidewords is rarely the primary goal of a research effort, however; typically guidewords are created as part of developing a new hazard analysis method. It is a challenge, though, to balance the goals of being both sufficiently expressive (so analysts do not miss potential causes) while also not being overly prescriptive (which can make the analysis unwieldy and verbose). In ASAP, we addressed this problem by defining two levels of tables which can be generated for every component, but this relies on a hierarchical organization of guidewords / error types.

The two-level approach taken by ASAP relies on a hierarchical specification of system error, i.e., a generic error type must be refinable into a set of more specific error types. AADL's EMV2 supports just such an approach [START_REF]SAE Architecture Analysis and Design Language (AADL) Annex[END_REF]; using it, system modelers or safety analysts can define custom error types, and then refine those into more specific types. Alternatively, the EMV2 standard comes with a predefined Error Library, which contains a straightforward decomposition of standard system errors [START_REF] Procter | The AADL Error Library : An Operationalized Taxonomy of System Errors[END_REF]. Typically, users combine the two approaches: they begin with the Error Library's set of error types and refine those to align with their domain or system. These custom error types are supported by the Unsafe Control Actions tables, so domain-specific extensions to the model will be fully incorporated. See Figure 6, which shows a graphical view of the EMV2 library's hierarchy of timingrelated errors, extended with custom error types specific to the PulseOx Forwarding application described in Section 3.2.

Tying it together: Focus

A common feature in diagrams used for safety analysis is a way to highlight a particular component or fundamental as well as those related to it, i.e., some way to call attention to system elements related to a specific hazard, accident, component, error etc. For fundamentals, this task is straightforward: we simply highlight the higher-level fundamentals which contain the focus target (i.e., move up the tree from Figure 2(a)) as well as all the lower-level fundamentals it contains (i.e., the subtree rooted at the focus target). Handling a focused Hazard or Constraint requires additional effort, though: recall that those fundamentals contain references to the system model, i.e., to error propagations occurring at specific component ports. Thus we include predecessors and successors, which are the components that might cause or be affected by the associated error propagation.

Thus, focusing on an error propagation or system component is significantly more complex than focusing on an Accident or Accident Level. We note that there is a related challenge in static analysis of software: it is often necessary to determine which program statements could have affected, or have been affected by, the program's state at a specific point in the source code. This issue is typically addressed through the use of program slicing, which Silva describes as "a technique for decomposing programs by analyzing their data and control flow" [START_REF] Silva | A Vocabulary of Program Slicing-Based Techniques[END_REF]. There are a number of program slicers available, we use one that has been built to run on AADL models [START_REF] Thiagarajan | Awas: AADL Information Flow and Error Propagation Analysis Framework[END_REF].

A backward slice finds system elements (or error propagations) which could potentially affect the focused system element (or cause the focused error propagation). Correspondingly, a forward slice finds system elements (or error propagations) which could potentially be affected by the focused system element (or have been caused by the focused error propagation).

Discussion

A safety analyst who wishes to use ASAP today, i.e., given existing regulatory regimes, will find it most useful to use the tool while developing the argument for certification authorities. They might begin by specifying metadata about her system using Viewpoint 1, check the inputs and outputs of a high-criticality component using Viewpoint 2, and then explore undocumented causes and compensations using AADL's EMV2 and Viewpoint 3's tables. In the longer term, we envision safety processes that support the interactive, query-/ view-driven approach explored in this work directly.

RELATED WORK

There is a large body of work that considers how the creation of and safety documentation should be automated. We differentiate the approaches into two groups, those whose automation is independent of a system's hierarchical decomposition and those who integrate with it more deeply. We discuss these groups with representative technologies.

Automated Assurance Cases

AdvoCATE [START_REF] Denney | Tool support for assurance case development[END_REF] is software developed by NASA that brings considerable automation to the creation of assurance cases, i.e., structured arguments that follow a defined, logical format. They incorporate both arguments and evidence, but are typically not as deeply integrated into a system's architecture as the arguments in ASAP. The methods of argument traversal are, however, similar to ASAP in that AdvoCATE supports, e.g., hierarchical abstraction and queries / views. However, these are queries and views of the argument itself rather than the system under analysis as was our goal.

Hierarchical Safety Analysis

Hierarchically Performed Hazard Origin and Propagation Studies (HiP-HOPS) [START_REF] Sharvia | Integrating model checking with HiP-HOPS in model-based safety analysis[END_REF] takes into account system hierarchy and supports compositionality. Compared to ASAP, it uses a more traditional (i.e., not system-theoretic) model of safety and accident causality, and it operates on systems in MATLAB rather than AADL / OSATE. HiP-HOPS' primary goal is the generation of hazard analysis reports, rather than deeply integrating safety information and argumentation into a system's architecture.

FUTURE WORK 6.1 Autogenerating Causes and Impacts

As discussed in Section 4.3 a fully-specified EMV2 description of a system encodes a machine-readable error path / event chain. In addition to the analyst-supplied narrative now visible in the unsafe control actions table, we are interested in transforming these event chains into something human readable. These causal event chains can be calculated using AWAS's backward slicing functionality [START_REF] Thiagarajan | Awas: AADL Information Flow and Error Propagation Analysis Framework[END_REF] (starting from either a constraint violation or an arbitrary error occurrence), though how these chains are best displayed to the user remains an open question.

AWAS's forward slice calculates the errors and failures resulting from an error's occurrence. These impacts could also be useful, though work would need to be done to align them with existing safety notions from, e.g., academic literature and / or safety standards. Once aligned, the best format for their presentation to the user would also need to be determined.

Alignment with Requirement Specifications

The goals and activities involved in safety engineering overlap to some extent with those involved in specifying a system's requirements. We expect requirement specification may evolve, somewhat, with the use of ASAP and are interested in exploring ways of supporting and automating more rigorous requirement specifications. However, we recognize that specifying functional and safety requirements simultaneously is not a straightforward task. There is research in this area from both system theoretic safety [START_REF] Scarinci | Requirement Generation for Highly Integrated Aircraft Systems Through STPA: An Application[END_REF] and architecture-centric perspectives [START_REF] Murugesan | Requirements reference models revisited: Accommodating hierarchy in system design[END_REF]; we are interested in seeing the extent to which ASAP's viewpoints can be extended or supplemented with additional requirement detail or traceability information.

CONCLUSION

In this paper we presented the Architecture-Supported Audit Processor, or ASAP, tool as well as its motivation and underlying theory. We applied it to a small example, demonstrated how it aligns with and improves upon a popular systemtheoretic hazard analysis, and discussed possible avenues for future improvements.

( 2 )

 2 Completely describing all aspects of the component: This description would have to analyze all possible uses in all possible contexts.

Listing 1 :

 1 An example of AADL's textual syntax, showing the specification of a software controller.

Figure 1 :

 1 Figure 1: The PulseOx Forwarding System, in AADL's graphical syntax

  n n e c t i o n Hazard = System State + Environment State (Error Type + Port) + (Component) Application

Figure 2 :

 2 Figure 2: Part (a): A diagrammatic view of the fundamentals hierarchy. Part (b): How hazards and constraints are modeled in AADL.

Figure 3 :

 3 Figure 3: A fundamentals hierarchy (i.e., an instantiation of Figure 2a) in the ASAP tool.

Figure 4 :

 4 Figure 4: The Connected Neighbors view of the app-Logic component in the ASAP tool. The primary element is shown in grey, immediate neighbors are blue, and the immediate neighbors of the neighbors are red. Connections represent the flow of data or commands.Note that this is a subgraph of Figure1

Figure 6 :

 6 Figure 6: Hierarchy of timing errors, adapted from [16].

Figure 7 :

 7 Figure 7: The Connected Neighbors view of the Patient, which has been selected as the current focus. Red elements are reachable from the focused element only via a backwards traversal. Blue elements are reachable only via a forwards traversal. Purple elements are reachable via both.

We recognize that this is not how electronic health records are typically used, here we use the term for a more generic data store.

STPA's full definition is "A system state or set of conditions that, together with a particular set of worst-case environmental conditions, will lead to an accident (loss). "[11, pg. 184]

Note that in STPA, hazards can be either states or conditions (Leveson has discussed their equivalence[START_REF] Leveson | Engineering a Safer World: Systems Thinking Applied to Safety[END_REF]) but in ASAP they must be conditions.

see, e.g., Ericson's text for the role of hazardous factors in accidents[START_REF] Ericson | Hazard Analysis Techniques for System Safety[END_REF].

Distance here is the number of "hops" from a given component, i.e., those which intransitively interfere according to van der Meyden's definition[START_REF] Van Der Meyden | What, Indeed, Is Intransitive Noninterference?[END_REF].

ACKNOWLEDGEMENTS

Copyright 2022 Carnegie Mellon University. This material is based upon work funded and supported by the Department of Defense under Contract No. FA8702-15-D-0002 with Carnegie Mellon University for the operation of the Software Engineering Institute, a federally funded research and development center. NO WARRANTY. THIS CARNEGIE MELLON UNIVER-SITY AND SOFTWARE ENGINEERING INSTITUTE MATE-RIAL IS FURNISHED ON AN "AS-IS" BASIS. CARNEGIE MELLON UNIVERSITY MAKES NO WARRANTIES OF ANY KIND, EITHER EXPRESSED OR IMPLIED, AS TO ANY MAT-TER INCLUDING, BUT NOT LIMITED TO, WARRANTY OF FITNESS FOR PURPOSE OR MERCHANTABILITY, EX-CLUSIVITY, OR RESULTS OBTAINED FROM USE OF THE MATERIAL. CARNEGIE MELLON UNIVERSITY DOES NOT MAKE ANY WARRANTY OF ANY KIND WITH RESPECT TO FREEDOM FROM PATENT, TRADEMARK, OR COPY-RIGHT INFRINGEMENT. [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimited distribution. Please see Copyright notice for non-US Government use and distribution. DM22-0095


Amine Abouaomar

Research Efforts in Mobile Edge Network Environments

Keywords: Edge computing, software defined networks, vehicular communication, federated learning, resource allocation, edge security

Mobile Edge Computing (MEC) has emerged in recent years as a way to reduce data transmission, decrease service latency, and reduce the load on the core network. MEC is expected to play a significant role in future communications networks, especially in providing services for new applications that involve high mobility or require high reliability and low latency communications. Edge computing relies on other technologies to achieve the desired performance, including network softwarization technologies (e.g., software-defined networking (SDN), network functions virtualization (NVF), and network slicing). Edge computing also enables edge intelligence, by hosting artificial intelligence (AI) and machine learning (ML) technologies, either to improve its own operation or to provide services to end users. Various MEC-related research efforts are underway in these areas as well as in the area of security and privacy in relation to MEC. This report provides an overview of some recent works in the area of MEC.

I. INTRODUCTION

Edge computing, a new extension of cloud computing,moves application placement out of centralized data centers to the edge of the network, close to users and data producers [START_REF] Filali | Multi-access edge computing: A survey[END_REF]. While Edge computing is an overarching concept, MEC is seen a telecommunications standard that provides computing and storage capabilities capabilities at the edge of the service provider's network. MEC allows processing close to the source, therefore achieving many benefits such as low latency, high bandwidth, and reduced backhaul bottlenecks. MEC is not only a technology tool for achieving key performance indicators (KPIs), but also plays a key role in the transformation of the sector [START_REF] Cherkaoui | Research landscape-6g networks research in europe[END_REF]. Indeed, telecom networks are becoming multi-purpose service platforms for industry and other specific customer sectors. Edge computing is driving this transformation, as it opens the network edge to thirdparty applications and services. In a broader perspective, the edge represents a whole new environment and a new value proposition. Operators and infrastructure providers are able to open their Radio Access Network (RAN) to independent and authorized entities, enabling them to deploy innovative services and applications in a fast and flexible manner. Some of the areas that can be improved through edge computing are edge analytic, location-based services, augmented reality, and vehicle-related services. To achieve the desired improvement in these areas, it is crucial to design solutions and schemes to effectively manage edge resources. It is well known that the edge is a highly heterogeneous environment where equipment is not only from different manufacturers and of different types, but also has limited resources. Such constraints have raised challenges in terms of resource management at the edge.In addition, it is essential to study the composition and placement of services at the edge under resource constraints [START_REF] Abouaomar | Mean-field game and reinforcement learning mec resource provisioning for sfc[END_REF].

Another concept that gathered a lot of interest in the research community is Edge intelligence. Edge intelligence refers to the extension of artificial intelligence to the edge of the network [START_REF] Taik | Empowering prosumer communities in smart grid with wireless communications and federated edge learning[END_REF], [START_REF] Taïk | Electrical load forecasting using edge computing and federated learning[END_REF]. This definition is not restricted to running AI models on servers/devices at the network edge, but also includes collaboration between the edge and the cloud, as well as leveraging AI to improve MEC. By adapting robust models to resource-constrained devices, AI will unlock the true potential of MEC. Previous work on AI has focused on deploying pre-trained models at the edge for inference. Nevertheless, privacy issues have generated a pressing need to push the training task toward the edge. In order to address these issues, federated learning emerged as a machine learning approach to train AI models using the user's data and devices without sharing the data with third parties [START_REF] Tak | Federated edge learning: Design issues and challenges[END_REF]. FL only allows sharing the trained model, which is presented in the following sections of this paper.

The security of edge computing networks has risen to the forefront of industry and academic concerns [START_REF] Filali | Multi-access edge computing: A survey[END_REF], [START_REF] Abouaomar | Resource provisioning in edge computing for latency sensitive applications[END_REF].MEC security challenges originate from the fact that MEC networks involve various parties employing different security policy requirements and measures [START_REF] Moudoud | Prediction and detection of fdia and ddos attacks in 5g enabled iot[END_REF], [START_REF] Moudoud | An iot blockchain architecture using oracles and smart contracts: The use-case of a food supply chain[END_REF]. Security management deficiencies among these parties can lead to potential security attacks. Therefore, security solutions must be designed to secure deployments of various MEC verticals such as Internet of Things (IoT) and Industry 4.0, etc. The interdependencies between MECs and network-based environments imply certain standardized requirements in terms of integrity, security, availability and confidentiality. It is therefore essential to design methods to secure MEC models and architectures, e.g., by predicting and detecting corrupted data injections.

Safety is among most critical factors in vehicular communication. Accordingly, the design of a vehicular ecosystem aims to provide adequate resources to ensure safety on the road [START_REF] Rachedi | Ieee access special section editorial: The plethora of research in internet of things (iot)[END_REF]. Vehicular communication systems integrate many diverse enabling technologies, including sensing, localization awareness, and decision making. With such constraints, many challenges are encountered in the design of vehicular communication systems. Indeed, these challenges arise from the requirement to process massive amounts of data from a wide range of real-time on-board sensors. Another challenge to consider is the high mobility of vehicles that imposes other types of requirements in terms of service continuity, latency and energy consumption (e.g., charging schedule for electric vehicles), as well as services migration [START_REF] Abouaomar | Service function chaining in mec: A mean-field game and reinforcement learning approach[END_REF]. Finally, safety cannot be ensured when the infrastructure's security is threatened/attacked. Therefore, it is imperative to protect the vehicle communication infrastructure from attacks at various levels of the sensing and computation pipeline.

This report summarizes most relevant research efforts in edge-cloud network environments related to (i) multi-access edge computing, (ii) edge intelligence through federated learning, (iii) softwarization of the networks and (iv) network slicing, and finally, (v) security and privacy preserving at the edge.

II. MULTI-ACCESS EDGE COMPUTING

In [START_REF] Abouaomar | A resources representation for resource allocation in fog computing networks[END_REF], a resource allocation scheme for fog computing was proposed with the aim of reducing the latency of applications and the fog resource consumption. Fog computing appeared as a promising paradigm for dealing with latency-critical applications, by keeping the data processing and analysis nearer to their sources. Owing to the heterogeneous nature of devices in fog, this work aims to cope with such issues. The resources types and the capabilities of the fog devices were represented in a uniform manner. The resource information then is being fed to a resource allocation scheme through the ETSI MEC API development, which is based on Lyapunov framework. Within a fog computing context, the work in [START_REF] Abouaomar | Matching-game for user-fog assignment[END_REF] investigated the users-fog assignment under latency and resource consumption context. The problem was framed as a correspondence/matching game between the users and the fog infrastructures. The game was solved through the multi-stage deferred acceptance algorithm (Gale & Shapely). Additionally, the equilibrium of the game was proved. The work in [START_REF] Abouaomar | Resource provisioning in edge computing for latency sensitive applications[END_REF] extends the work in [START_REF] Abouaomar | A resources representation for resource allocation in fog computing networks[END_REF] to consider not only the resource representation, but the queuing dynamic and the resource allocation frequency. The resource representation is exposed to the supervisor of the network, which have the role of shaping the resource allocation schemes. The queuing dynamic was studied through the optimization of Lyapunov and the driftplus-penalties framework. The resource allocation frequency is based on the load of the edge nodes in termes of resources. Simulation in this work were conducted on a testbed. The work in the paper [START_REF] Mlika | Massive access in beyond 5g iot networks with noma: Np-hardness, competitiveness and learning[END_REF] addresses the problem of clustering, scheduling and provisioning of online users in Internet of Things networks beyond cellular 5G. The NOMA method has been adopted to accommodate many devices within the same wireless resources, mainly as a result of the massive number of devices that seek to access the network. Contrary to most prior work, we aim to maximize the number of served devices while simultaneously having to allocate their transmit power to fulfill both their real-time demands and their limited operational power. Initially, the problem was formulated as a mixed-integer nonlinear program (MINLP) that can be easily relaxed into a MILP for particular scenarios. Subsequently, the work examined the problem's computational complexity by identifying the NP-hardness of the particular scenarios. Finally, through splitting up the problem into multiple NOMA clustering and scheduling subproblems, the work has proposed an efficient online competitive algorithm. Finally, the work has shown possible paths for using these online algorithms and bringing their solutions into a reinforced learning environment to reach energy provisioning and thus solve the global problem.

The work in [START_REF] Mlika | Competitive algorithms and reinforcement learning for noma in iot networks[END_REF] has studied the problem of massive Internet of Things (IoT) access in 5th generation (B5G) networks using non-orthogonal multiple access (NOMA) techniques. This problem requires massive clustering of IoT devices and power supply to satisfy the low latency as well as limited operating energy of IoT devices. The objective function considered is different from the traditional throughput and sum objective functions, given that it maximizes the incoming IoT packets. Firstly, the problem is decomposed into various NOMA clustering subproblems. Secondly, the work has proposed an efficient online competitive algorithm to solve each sub-problem. Finally, a novel reinforcement learning (RL) framework has been proposed to overcome the power allocation problem. In this framework, an RL agent is trained to utilize the competitive algorithm as a black box and combines the obtained solutions for every sub-problem to decide the power provisioning for each NOMA cluster.

The work by [START_REF] Nour | Matching-based service offloading for compute-less driven iot networks[END_REF] has presented a matching-based service offload scheme for computer-less IoT networks. This work has adopted the matching theory to match service offloading to suitable edge servers. The framework proposed represents a vertical many-to-many offloading scheme which focuses on offloading the frequently requested and reusable services to appropriate edge servers. This has been extended to support horizontal sharing of one-to-many computation reuse between the edge servers, which allows less computation to be pushed to the cloud.

The work of [START_REF] Baseri | Privacy preserving fine-grained location-based access control for mobile cloud[END_REF] have investigated the feasibility of delivering location-based services for conditional access control in mobile cloud. Specifically, this paper proposed an attribute-based multi-authority-controlled access policy to handle co-existence of multiple authorities, then, to ensure users' anonymity, and finally, to safeguard their identities from untrusted authorities. The solution proposed in this work uses the dynamic location of users as a context-centric information, leverages the location constraints as a policy in attribute-based encryption, and authorizes users whose dynamic location satisfies the access policies. The proposed attribute-based encryption is integrated with re-encryption at the proxy level to, first, transform secret valuable information from various authorities and protect the identities of mobile users from begin leaked on the cloud side, and then, outsource the computation to a cloud infrastructure with "infinite" computing resources. This improves efficiency and reduces computational overhead for mobile users with limited resources.

In [START_REF] Chakroun | Reducing energy consumption for reconfiguration in cloud data centers[END_REF] a new algorithm was proposed to optimize edge resource allocation techniques for edge infrastructure based on the optimization of stochastic networks. The primary focus of this approach is to minimize the power consumption at the cloud datacenter level while simultaneously achieving resource elasticity to meet users' requirements and guarantee a high-availability computing platform. This works selected overclocking techniques to enhance server capabilities and Lyapunov optimization to provide a stable design and minimize energy cost. More extensive work was presented in [START_REF] Chakroun | Resource allocation for delay sensitive applications in mobile cloud computing[END_REF], that aimed at minimizing the user's requests delay and to simultaneously improve the resource availability. A Lyapunov drift plus penalty-based optimization was proposed to ensure design stability and to minimize the delay cost function.

The work in [START_REF] Jalil | On channel reuse for cloud network users[END_REF] addresses the assignment of channels for users in cloud networks according to the information from the application layer. This work assumes a multi-user driven network where services requested by users are classified into delay-tolerant and real-time services. The suggested approach allocates each wireless channel to a user requesting a realtime service. Taking inspiration from the cognitive networks, this work aims to allocate the very same channel to another user requesting the delay-tolerant service, while at the same time reducing the interference. The goal is to make such allocations simultaneously so that the SNR of the less favored user is maximized. Such allocation is much more efficient than allocating channels separately to real-time users and then to delay-tolerant users. The resulting allocation problem is shown to be NP-hard. This work proposed a straightforward algorithm to solve this problem. Additionally, the proposed scheme is proved that the proposed algorithm gives near-optimal results.

III. FEDERATED EDGE LEARNING

Federated learning is a technique for distributed machine learning, where every device is contributing to a learning model through independent computation of gradient over its local learning data [START_REF] Tak | Federated edge learning: Design issues and challenges[END_REF], [START_REF] Taïk | Clustered vehicular federated learning: Process and optimization[END_REF]. Such technique has recently risen to the forefront of research, since it promises several improvements in terms of data privacy and scalability. However, it is challenging to implement federated learning at the network edge given the heterogeneity of the data, the systems, and the resources. The existing challenges and tradeoffs in federated learning at the edge were investigated in [START_REF] Tak | Federated edge learning: Design issues and challenges[END_REF]. The design of federated edge learning algorithms for resource efficient learning poses a number of challenges. Essentially, multidisciplinary-related nature of the problem. Since data is the core of the learning process, this work requires a new set of criterions regarding the properties of data for wireless scheduling algorithms in federated learning. Therefore, this work provides a comprehensive framework for data-aware scheduling that provides a guideline for future directions in federated learning research. Work [START_REF] Taik | Data-aware device scheduling for federated edge learning[END_REF] unlike previous work in which data aspects were barely studied, this work takes into account the characteristics of the data in the proposed algorithm of scheduling. For this purpose, this work has provided a scheduling algorithm for non-independent and identically distributed and non-balanced sets of data. In the proposed algorithm, the work has taken into account data and resource perspectives. In addition to minimizing the federated learning time of completion by the edge along with the transmit energy of the involved devices, this algorithm gives preference to devices having diverse and rich set of datasets. This work has defined a comprehensive data aware scheduling framework, as well as the main lines and requisites for assessing diversity. Then, the work has addressed the aspects of diversity and some processes and measures that can be exploited. In the same context, however, under constraints of high communication rates, federated learning at the edge must be tailored to constrained communication resources. In addition, the heterogeneity of local data distributions as well as the uncertainty in data quality raise very interesting challenges for training convergence. Therefore, the participating devices should be carefully selected, and an equivalent bandwidth provisioning is required. Always on federated learning, the work in [START_REF] Taïk | Data-quality based scheduling for federated edge learning[END_REF] proposed a scheduling algorithm based on the quality of data. This scheme put devices that are considered to be reliable in priority due to their divesity and rich datasets. The proposed work has defined the various elements of the learning algorithm and the evaluation of the data quality.

Although the hype in the federated edge learning-related research, few works actually investigated it through a precise use case. [START_REF] Taïk | Electrical load forecasting using edge computing and federated learning[END_REF] Within a smart grid scenario and precisely data from 200 houses from the state of Texas in the united states, where considerable amounts of electrical consumption data were used for models' training for applications to monitor demands and loads responses. This work evaluated using federated learning at the network edge, as a machine learning scheme in a decentralized fashion. Such an approach allows increasing both diversity and volume of the used sets of data in the training process of deep learning models with corrupting the data privacy. This work is considered as one of the very few works to achieve promising results in using federated learning to forecast household electrical loads. In the context of use cases, the work in [START_REF] Taik | Empowering prosumer communities in smart grid with wireless communications and federated edge learning[END_REF] investigated the prosumer communities to achieve collective objectives regarding the energy consumption in the smart grid. Individual consumer decisions are driven by individual livelihood goals. Consequently, the framework gives priority to consumers' individual decisions and relies on the 5G network to provide coordination among different community members.

The work in [START_REF] Nour | Federated learning and proactive computation reuse at the edge of smart homes[END_REF] investigated communication and computation problem in the network edge by highlighting the privacy of data in smart household use case. This work has resulted in an architecture that includes federated learning at the edge to ensure the confidentiality of data and a weighted node elimination scheme to choose suitable candidate devices with high quality data, which improves training and reduces communication costs. Additionally, The work employ longterm memory to proactively forecast and store future tasks at the edge level. This work includes the reuse of computations to address incoming tasks with small or zero computations, thus excluding recurring computations and reducing the cost of computations.

IV. SDN/NFV ROLE IN EDGE-CLOUD NETWORKS

As an edge computing key enablers, emerging from the virtualization technologies. Software defined networks and network function virtualization reshaped the environment not only on the cloud but at the edge also. Function can now be abstracted into software pieces allowing easy, efficient and scalable deployment of the equipment with lower cost [START_REF] Abouaomar | Service function chaining in mec: A mean-field game and reinforcement learning approach[END_REF], [START_REF] Filali | Sdn controller assignment and load balancing with minimum quota of processing capacity[END_REF]- [START_REF] Filali | Preemptive sdn load balancing with machine learning for delay sensitive applications[END_REF].

To ensure the scalability of SDN-based edge computing networks, the work in [START_REF] Filali | Preemptive sdn load balancing with machine learning for delay sensitive applications[END_REF] proposes a preemptive mechanism to balance the load in an SDN control plane distributed architecture. The proposed mechanism uses an LSTM-based long-term prediction model for SDN controllers loads. Accordingly, the controller load predictions of long-term order enable preemptive detection of the load nature (i.e., balenced/unbalanced) in the control plane. Based on the forecasting results, data plane migrations can be in advance scheduled. To improve the efficiency of migration operations, the load balancing problem was formed as an optimization problem willing to find the tradeoff between load balancing factors and migrations cost. To solve this problem, a reinforcement learning (RL) algorithm is proposed. When the load becomes imbalanced in the control plane, an RL agent efficiently selects data plane components to be migrated and the location of the migrations.

In [START_REF] Filali | Prediction-based switch migration scheduling for sdn load balancing[END_REF], a prediction-based data plane component migration scheduling algorithm is designed to balance the load among SDN controllers in a 5G network. The proposed algorithm leverages an auto-regressive integrated moving average (ARIMA) multi-step prediction model to forecast the load of SDN controllers. Then, when a controller overload is predicted, a data plane component is chosen to be migrated from the overloaded controller to a less loaded controller. This proactive algorithm ensures that the load in a distributed SDN control plane remains permanently balanced.

In [START_REF] Abouaomar | Service function chaining in mec: A mean-field game and reinforcement learning approach[END_REF] the problem of service function chain resource allocation at the edge. An SFC is a set of VNFs chained to shape a service. The problem consists in solving three subproblems, namely, the VNFs placing, VNFs chaining, and VNFs scheduling. The first two subproblems (i.e., placing and chaining) is tackled under the same formulation, while the third subproblem (i.e., VNFs scheduling) is tackled as a single formulation. The first formulation was formulated as a mean-field game, for which the equilibrium was analyzed mathematically and analytically. The game was solved through iterative learning. The scheduling problem was formulated as a matching game (many-to-one) to match edge resources to VNFs requirements. This work investigated additionally, to the latency and the consumption of resources, the execution time of the proposed scheme themselves, which turn out to be very low compared to other schemes from literature. Within a context where the services are not only to be placed or chained, but to be migrated from an infrastructure to another. In [START_REF] Abouaomar | A deep reinforcement learning approach for service migration in mec-enabled vehicular networks[END_REF], a service migration scheme was proposed having the role of guaranteeing the continuity of the services while offering a lower latency. The work leveraged the deep reinforcement learning to offer efficient solutions. The problem was modeled as a multi-agent Markov decision process and solved through deep reinforcement learning algorithm, which allows a proactive migration of services and simultaneously enabling the continuity of services within high mobility use cases.

The manufacturing processes are becoming more automated and it is now recognised that both the manufacturing process and the objects it produces can be interconnected in the post-manufacturing stage. Based on this requirement, a chatty factory is about making products that can send data back to the production and manufacturing landscape as they are used, while ensuring the protection of their users' privacy. The expected utilization of a product during its designing is sometimes quite different than its actual utilization. By under-standing the purpose of this data to sustain ongoing product refinement and by understanding how the fabrication processes can be adjusted dynamically according to the availability of the data, a number of opportunities exist. The work [START_REF] Lakoju | chatty devices" and edge-based activity classification[END_REF] describes how collected product usage data can be leveraged to: categorize product usage; match a label to product usage through the use of unsupervised learning; and feed this data into a cloud-based environment in which labels can be mapped to multiple products of the same type. Federated learning policies are leveraged across all devices to ensure that all data captured from a given product may be analyzed on a local basis, thereby maintaining confidentiality of the data.

Vehicles have embedded software for a variety of functionalities ranging from driver assistance to entertainment. Automobile manufacturers are often required to update embedded software on their vehicles. Software updates are available through the vehicle manufacturer to provide patches or requested by vehicle proprietors to upgrade some functionality. The work [START_REF] Azizian | Vehicle software updates distribution with sdn and cloud computing[END_REF] proposed an architecture to distribute software updates to vehicles through SDN and cloud computing. It is shown that using SDN in providing on-demand network programmability, allows substantial flexibility for deploying in-car software updates. Alternatives for modeling vehicle networks are presented, particularly in the format of a connectivity map which can be used as an entry into the SDN infrastructure. This work presented an SDN-driven approach in which multiple frequencies are assigned to various edges of the network to enhance performance of the network.

V. EDGE COMPUTING FOR VEHICULAR COMMUNICATION

Work [START_REF] Salahuddin | Rsu cloud and its resource management in support of enhanced vehicular applications[END_REF] proposed RSUs as an approach to deliver unsecured QoS-aware VANETs applications. The architecture of cloud-based RSUs is composed of legacy RSUs, dedicated micro-datacenters, and VMs using SDN. But frequently changing service hosting decreases the services delivery and increases the costs of service providers. This work employed Mininet as an analysis tools to quantify the reconfiguration of the overhead. The proposed scheme minimizes the reconfiguration overhead, the costs of service deployment, and routing delay at the infrastructure side jointly. This work was considered as the first of its kind to use this approach. The work benchmarked the purist approach's performance against an ILP scheme and an innovative heuristic for the proposed technique.

Smart grid as a collection of operating and management frameworks for electricity provision is an enabler for electrical vehicles. It allows both providers and consumers to better monitor electrical consumption through the two-way communication of electricity and information between grid nodes. With the advent of electrical vehicles (EVs) hitting the roads, and considering the charging time required for batteries, there is a need for wireless-based communication between EVs and the charging stations to check availability and pre-book charging spots. In [START_REF] Rezgui | A two-way communication scheme for vehicles charging control in the smart grid[END_REF], the authors presented a novel protocol for EV to EVSE communication that provides a reliable reservation process. Within the same context, the smart grid is also called upon to meet the high energy requirements. To address this issue, efficient electrical load scheduling techniques are needed. In [START_REF] Said | Scheduling protocol with load managementfor ev charging[END_REF] a scheduling protocol with a load control scheme is developed. The scheduling protocol first aims at minimizing the peak loads caused by recharging a number of EVs at homes while applying charging policies. Second, it aims to achieve the tradeoff between charging and discharging in order to achieve cost optimization and improved grid stability. Analytical formulation is provided for the scheduling process problem with a load management policy. A simulation framework for IEEE 802.11p wireless technology in the NS-2 simulator was developed to perform an evaluation of wireless technology for vehicle-based networks [START_REF] Gukhool | Handoff in ieee 802.11 p-based vehicular networks[END_REF]. Besides, handover techniques for the early technology were also included into the framework. The framework is intended to reproduce, as closely as practicable, characteristics of the access technology in the simulator and, through scenarios, gives an objective performance overview of the applications for ITS. The framework is being claimed to be the first of its kind open to the research community and developed to support the specifications required for vehicleto-infrastructure communications, with particular emphasis on the handover process in the IEEE 802.11p infrastructure mode of operation. Urban sensing also have emerged as an important technique for vehicle networks. It provides users with access to a data pool gathered by on-board sensors. Aggregation is an efficient approach towards converting the data collected from the sensing into a utilizable shape. One effective way to aggregate is to partition the network into multiple geographic areas, called aggregation areas. The work of [START_REF] Sahoo | Optimal selection of aggregation locations for urban sensing[END_REF] provided a mechanism for constructing aggregation areas based on the location of RSUs This work has proposed an optimization policy to identify the optimal aggregation region which minimizes vehicular communication delay. M2M concept introduced into the vehicular communication have the potential of improving electric vehicle networking through two-way communication between EVs and the charging suppliers. The work [START_REF] Rezgui | An m2m access management scheme for electrical vehicles[END_REF] investigated the performance effects of a significant number of connected EVs trying to exploit the random access of LTE-Advanced to transmit information to the network. An effective solution is proposed to overcome the congestion over the channel access in LTE-Advanced for massive EVto-charging stations communications. In this solution, the work distinguishes two categories of communication service between EVs, prioritizing charging requests over other types of low-priority messages such as promotions, subscriptions, mechanical checks, etc. This work presented an admission control framework to manage machine to machine traffic of electric vehicles over LTE-Advanced and provide QoS to load request messages based on tight delay to prevent higher values of latencies for electric vehicle users and the network load conditions.

In [START_REF] Abid | Pedestrian collision avoidance in vehicular networks[END_REF], a performance review conducted by means of the WAVE/DSRC standard with the inclusion of pedestrians. In the first stage, the work has proposed a dedicated message format to embed pedestrian and two-wheeler positioning information. Next, a comprehensive collision avoidance scheme at the intersection was proposed. A comparison between two schemes was proposed. The first consists in announcing and transmitting messages on the control channel. The second consists in using the control channel after announcing the service. Also this work has considered various densities of the network, and provides a study for the operational modes that minimize the congestion and the saturation of the channels. The findings of this work are pertinent to designing data transmission models for avoidance systems of pedestrians at the intersections through VANETs.

In a scenario of a vehicle failure and/or transmission of false information by a malicious vehicle, it is critical to quickly detect the failing/malicious vehicle and adjust the message exchange routine consequently. In [START_REF] Rezgui | Detecting faulty and malicious vehicles using rulebased communications data mining[END_REF] a mechanism has been developed which gathers, on a single vehicle basis, data about each adjacent vehicle transmission, as well as extracting the time correlation rules among the vehicles participating in the transmissions in the vicinity. In doing so, faulty or malicious vehicles are detected. This mechanism is referred to as VANETs Association Rules Mining (VARM). A mining operation occurs over an historically constant period of time. The association policies formulated during the mining process are employed to identify faulty or maleficient vehicles. To respond after such a fault detection, a 1:N technique has been employed as a safeguard to recover the precision of the data collection operation among the communicating vehicles.

In [START_REF] Azizian | Dcev: A distributed cluster formation for vanet based on end-to-end realtive mobility[END_REF], a distributed clustering approach was proposed. Referred to as DCEV, it is constructing multi-hop clusters. DCEV sorts vehicles through the feature of non-overlapping clusters with a size that scales according to the vehicles' mobility. A D-hop clustering scheme is leveraged with each node choosing their cluster leader at a distance of at most D hops. DCEV forms clusters through a metric that allows vehicles to select the more stable path to the required cluster leader in their D-hop neighborhood. Consequently, each node calculates its relative mobility's average for all discovered routes. DCEV selects routes having least relative mobility.

In [START_REF] Azizian | An optimized flow allocation in vehicular cloud[END_REF] a vehicular cloud model is taken, in which vehicles provide data as a service. The work shaped schemes to efficiently deliver data through scheduling transmission manner when the vehicles collect data of their environment from their sensors. To achieve this, initially, it is required to arranged vehicles into clusters, in a way where each cluster operates as a vehicle cluster. Consequently, the work resented a distributed D-hop clustering algorithm to shape clouds of vehicles in a dynamic manner. The approach clusters the vehicles into non-overlapping groups, which are sized accordingly to their mobility. vehicle clusters are formed in a way making a vehicle in no more than D hops from a the broker at the cloud side. Each vehicle selects a broker according to the relative mobility estimation of their neighbors at D hops. After constructing the cloud, a scheduling optimization that both maximize the throughput and minimize the delay is proposed to deliver the vehicles' data to the associated broker vehicle cluster.

The sensed data should be aggregated, to minimize the utilization of the bandwidth and improve the content value. An aggregation is qualified as efficient if the destination have the ability and capacity to collect sensed data from a huge number of vehicles. Given a huge number of vehicles are attempting to transmit the data collected from sensors, the network gets overloaded, thus, leading to high number of collisions and loss of packets. Therefore, the aggregation should be conducted regardless of important considerations (e.g., a significant number of vehicles and the dynamic of the network), achieving an efficient sensed data collection is quiet challenging, especially, at the destination end. The work [START_REF] Sahoo | Dynamic hierarchical aggregation for vehicular sensing[END_REF], [START_REF] Sahoo | Hierarchical aggregation for delay-sensitive vehicular sensing[END_REF] proposed a dynamic and hierarchical aggregation framework where the data of collected sensors is hierarchically grouped. Furthermore, this hierarchy is updated according to the delivery efficiency being estimated theoretically. In particular, split and merge processes are performed in a hierarchy fashion to obtain a better delivery efficiency value.

Within a heterogeneous network environment, an efficient mobility management framework is needed to achieve the best continuous connectivity. [START_REF] Andersson | Mobility management for highly mobile users and vehicular networks in heterogeneous environments[END_REF] has proposed a mobility management system focused on providing efficient selection of the network and the timely processing of horizontal and vertical handovers. This solution is based on the use of mobile IP, in which handover criteria are based on a combined delay and jitter metric calculation. For efficiency, the update rate of the links is monitored dynamically, based on speed and metric variations. The dynamic link update frequency ensures timely detection of busy points of access and cellular boundaries allowing for efficient handoffs minimizing packet loss as well as handoff delay.

The work in [START_REF] Bourass | Secure optimal itinerary planning for electric vehicles in the smart grid[END_REF]- [START_REF] Bourass | Intelligent route guidance for electric vehicles in the smart grid[END_REF] has proposed a secured infrastructure in which EVs and smart grid share information for scheduling itineraries and booking recharging time slots at charging stations. This architecture ensures privacy and incorporates authentication and permission to secure critical information of EVs. The work introduced a novel framework for EV route scheduling, which considers the EV's charging status, its destination, and the available charging sites on the itinerary. The framework minimizes the EV's waiting time and its overall energy consumption to arrive at its destination. Withing the same context, [START_REF] Said | Guidance model for ev charging service[END_REF] has presented a model for guiding system to reduce the delay in waiting time of an EV to be plugged in for charging service at the public charging nodes. This work has proposed an algorithm to guide vehicles to the charging stations in a manner that helps minimizing their searching time to reach a charging station.

VI. NETWORK SLICING AT THE EDGE-CLOUD

The multi-agent resource provisioning problem in vehicular networks using NOMA and network slicing is still facing various challenges. The heterogeneity in quality-of-service demands, sharing of data collected from sensors in a scenario of high-speed communication, and the very low latency requirements, are all examples of such a challenges. To guarantee service heterogeneity demands, the work of [START_REF] Mlika | Network slicing for vehicular communications: a multiagent deep reinforcement learning approach[END_REF] proposed slicing-based network architecture. Under these challenges, resource provisioning between vehicles is highly challenging, primarily due to the highly varying channels between vehicles (highly moving), and the absence of a central decision making entity. Therefore, to perform centralized resource provisioning based on instantly collected information about the state of the channel is not possible.Resource provisioning is involving traditional allocation of power and radio resources, in addition to the selection of coverage and packet. To this end, this work provides first a mathematical formulation and an integral analysis of the problem's NP-hardness, and model a multiagent Markov decision process for the problem. Finally, this work employs a deep reinforcement learning approach to solve the formulated problem. The solution is practical due to its implementability as an online solution, additionally, to the distributed implementation. The solution is based on collaborative learning approach where each agent perceives a reward and enhance it in both distributed and cooperative way. The resource provisioning schemes are enhanced using offline training. In [START_REF] Mlika | Network slicing with mec and deep reinforcement learning for the internet of vehicles[END_REF] as in [START_REF] Filali | Communication and computation o-ran resource slicing for urllc services using deep reinforcement learning[END_REF], [START_REF] Filali | Dynamic sdn-based radio access network slicing with deep reinforcement learning for urllc and embb services[END_REF] proposed a deep reinforcement learning-based scheme to address the resource provisioning problem at the vehicular edge using network slicing. This solution leverages non-orthogonal multiple access to better utilize channel resources. The problem addressed channel slice selection, vehicles clustering, and power provisioning,. Specifically, the problem has been formulated as a Markov decision process. The solution was provided using deep reinforcement learning.

The work in [START_REF] Messous | A game theory based efficient computation offloading in an uav network[END_REF] tackled the problem of offloading compute-heavy UAV tasks whilst achieving the best possible trade-off between energy consumption, delay and computational cost. The focus was on the scenario of a UAV fleet carrying out an exploration mission. In the course of the mission, these constrained UAVs need to carry out very compute-intensive tasks such as pattern recognition and video pre-processing. Specifically, this problem was formulated by using a theoretical non-cooperative game with N participants and three pure strategies. The work also proposed a complete Nash equilibrium proof and implementation of a distributed algorithm that converges to such an equilibrium. Work in [START_REF] Amine | A many-to-many matching game in ultra-dense lte hetnets[END_REF] provided an energy efficient model for users in ultra-dense LTE HetNets. In such an environment, the degradation of uplink performance at SBSs is a real challenge. To overcome the heavy interference between tiers, each SBS is attempting to open access to macro users who will eventually accept only an SBS with a SINR offer that is maximal. Consequently, arising a congestion problems of the network on the SBSs level. Such a problem was formulated as a matching game, solved through computing the stable and optimal many-to-many assignment, which consists of assigning each macro user with multihoming capabilities to the best suited SBSs and so on. In addition, this solution can provide a well balanced loads within the environment of HetNets.

VII. SECURITY OF EDGE NETWORKS

Vehicular communication raises many challenges for the next generation roadside services. Some of the critical issues that need to be addressed are those of reliability, security, and billing, along with ensuring scalability of service distribution. The work of [START_REF] Coronado | Performance analysis of secure on-demand services for wireless vehicular networks[END_REF], [START_REF] Habhouba | Decision-making assistance in engineering-change management process[END_REF] addressed the provision of secure service session metrics for the receipt of service requests ondemand through an existing service domain, and discussed the performance of the underlying mechanism. This work introduced three classes of service request protocols, which are defined as multi-hop, single-hop, and extended connectivity service requests. A comprehensive analytical model and cost study for the access protocols are discussed. The analytical study focused on estimating the overall latency cost of each access protocol with different mobility and vehicle density models in the service coverage area and in different service district domains. The work of [START_REF] Baseri | K-anonymous location-based fine-grained access control for mobile cloud[END_REF] studied location-based service provisioning for access control in the mobile cloud based on attributes. This work proposed a multi-authority attribute-based access control framework and safeguards users' privacy from malicious entities. The composed framework exploits the dynamic location of the mobile user as background knowledge about the user, employed the coarse location as an attribute in attribute-based encryption to achieve K-anonymity, and filtered the returned results for increased precision. The attribute-based encryption is incorporated into re-encryption by proxy to externalize the computation to a cloud server with "limitless" computing power. The proposed framework is costeffective as it reduces the computational cost for mobile users with limited resources.

The growth of IoT is still challenged by a range of privacy and security issues which must be addressed. In such a ubiquitous and diverse setting, dynamically and routinely changing contextual requirements, there is a need for effective and contextually adaptive systems to meet the changing needs of users. Hence, designing an adhesive access control systems to remote control smart objects while considering dynamically changing contextual conditions looks crucial. In [START_REF] Arfaoui | Context-aware adaptive authentication and authorization in internet of things[END_REF] and its extension in [START_REF] Arfaoui | Context-aware adaptive remote access for iot applications[END_REF], they presented a attribute-based, context-aware access control scheme that incorporates contextual information with attribute-based encryption of ciphertext policy to achieve data privacy and adaptive contextual security. The suggested design satisfies the requirements of security such as context-aware confidentiality, privacy, and tolerance against the key escrow problem.

Although blockchain has been used primarily for cryptocurrencies, it has become a trusted tool for the Internet of Things. Nevertheless, naively using blockchain for IoT results in experiencing high latency and high calculation time. The work of [START_REF] Moudoud | An iot blockchain architecture using oracles and smart contracts: The use-case of a food supply chain[END_REF] proposed a blockchain design to be employed in a blockchain that includes different distributed IoT entities, as well as a lightweight consensus for this design.

Work of [START_REF] Baseri | Controlling cloud data access privilege: Cryptanalysis and security enhancement[END_REF] addressed a certain number of weaknesses concerning fine-grained access control, user-authority collusion attack, user authorization and user privacy protection. Subsequently, proposing a novel scheme surmounting these weaknesses. A demonstration of the robustness of this scheme has been performed on authority collusion attacks, user collusion attacks and chosen plaintext attacks. Finally, it is shown that the effectiveness of our scheme is comparable to existing schemes. The work of [START_REF] Moudoud | Prediction and detection of fdia and ddos attacks in 5g enabled iot[END_REF] proposed a hierarchical architectural framework for securing edge IoT networks, as well as a comprehensive security framework for predicting and detecting false data injection and distributed denial-ofservice attacks. The compound security framework is built on a Markov decision process, which is used to monitor the performance of each individual device in the network, and use a range-based behavior filtering scheme.

IoT blockchain embedding is still facing various issues such as scalability and flexibility. Resources provisioning to handle a large number of interconnected IoT devices involves the need for a scalable and more a flexible blockchain. To surmount these problems, the work [START_REF] Moudoud | Towards a scalable and trustworthy blockchain: Iot use case[END_REF] proposed a scalable and trustworthy blockchain-based architecture suitable for IoT, that leans on sharding and blockchain oracles to establish trust between the untrusted IoT devices in a distributed and trusted manner. This work designed a network of Peer-To-Peer oracles that ensures data reliability, scalability, flexibility, and trustworthiness. In addition, this work introduced a new lightweight consensus driven algorithm that scales the blockchain beyond recognition while ensuring interoperability among blockchain contributors.

Cyber mobile physical systems involve huge amounts of data gathered by various sensors and cameras integrated into vehicles. Collaborative sensing is a model widely promoted by cyber-physical based systems to provide an intelligent knowledge base to consumers using various sensed data provided by willing contributors. Aggregation is a sustainable approach to transform sensed data into a usable format. An efficient way to perform aggregation is to partition the network into a number of geographic areas, called aggregation areas. In [START_REF] Sahoo | Optimal selection of aggregation locations for participatory sensing by mobile cyber-physical systems[END_REF], a new scheme has been proposed to identify aggregation zones based on the location of access points. In addition, this paper proposes a method to identify the ideal aggregation location that minimizes the delivery delay of the detected data.