## 4 Results
### Software Implementation  
Having introduced the theoretical concept of our software architecture, we describe how we implemented the software as a prototype. The presented architecture was implemented using rapid prototyping [42]. The source code of the implementation and the running prototype can be found online [36]. Note that our software architecture presented in Section 4.1 was formulated generally. Consequently, the approach we present can be used for configuring a variety of cloud applications. Our prototype is designed for the configuration of an intrusion-detection system (IDS). The concept of the implementation is illustrated in Figure 6. The developed prototype should automatically and transparently configure an IDS and notarize its configuration implementation. The prototype used the Microsoft Azure Cloud as a cloud instance and deployed two virtual machines (VMs) of the \"Standard B4 ms\" type, with 5 vCPUs, 16 GiB RAM, and 30 GiB disk storage on the MS Azure Cloud. For identification, the deployed VMs were termed VM1 and VM2. Ubuntu Server 18.04 Long-Term Support (LTS) was installed on both VMs as the operating system. Regarding the notarized configuration of the IDS, the Ethereum blockchain [43] was subsequently employed to implement smart contracts. On VM1, Ganache Command Line Interface (CLI) v7.0.4 was installed [44].  
Moreover, Ganache CLI was employed to run an Ethereum blockchain for development. Since the Diffie-Hellman protocol is vulnerable to MITM attacks, the created management smart contract must ensure the authenticated provisioning of the public Diffie-Hellman keys [38]. The blockchain provided by the Ganache CLI could be accessed through a standardized interface. This standardized interface enabled the script-based use of the blockchain provided in VM1. Solidity [45] was used as the programming language, allowing the management smart contract (Web3.py) to interact with the Ethereum blockchain via a script-based client [46] and the digital signing scheme that the Ethereum blockchain provides.  
Within VM2, this prototype ran two applications and the proposed cloud management script. The Microsoft Azure Software Development Kit [47] was employed for the cloud management connection. The initial application was an Nginx version 1.21.0 web server, which was used for providing a template website containing static demo web content. The second application was the IDS, which had to be configured using this proposed approach. Consequently, the IDS Snort in version 2.9.8 [48]--a signature-based intrusion-detection system upstream of the webserver--was used. We used a cryptographic hash function to generate the snapshot hash value described in the architecture in Section 4.1.2. The use of cryptographic hash functions ensures that the hash value generated by the VM can be used in litigation to prove that a configuration has been changed. It is computationally infeasible to preserve the original input value of a cryptographic hash function [49]. This thus ensures that a generated hash value cannot be implemented with a manipulated VM and, thus, with a forged configuration. The prototype we developed uses the SHA-512 hash function for this purpose. Even though SHA-256 is often used in blockchains, we decided to use the SHA-512 hash function. In the architecture we presented, the operating system performs the hashing. Today's operating systems mostly run with 64-bit memory management. Research has shown that the SHA-512 hashing algorithm might run faster on larger data sets and 64-bit systems than SHA-256, due to parallelization [49].  
Based on our mathematical definition of the configuration \(c:\sum^{*}\rightharpoonup(I^{\texttt{UL}}\to\mathcal{O}^{\texttt{UL}})\), \(\sum^{*}\) is the English alphabet, which is mapped to an input-output behavior \((I^{\texttt{UL}}\to\mathcal{O}^{\texttt{UL}})\) only if the described text represents a valid snort rule.