Juan Bicarregui Head of e- -Information Information Head of e - - PowerPoint PPT Presentation
Information Systems Research and Development at CCLRC Accelerating Innovation Through Technology Transfer Juan Bicarregui Head of e- -Information Information Head of e Rutherford Appleton Laboratory Rutherford Appleton Laboratory
FMICS 2003, Roeros, June 2003
Accelerating Innovation Through Technology Transfer
Head of e Head of e-
Information Rutherford Appleton Laboratory Rutherford Appleton Laboratory
Council of the Central Laboratory of the Research Council of the Central Laboratory of the Research Councils Councils
2
FMICS 2003, Roeros, June 2003
Facilities include:
Who we are: CCLRC Who we are: CCLRC Also Spin-in/out Companies:
3
FMICS 2003, Roeros, June 2003
Information Systems and Services Information Systems and Services
Information Science and Engineering Group
IS Research and Development EU & UK Research, In-house projects R&D, Private Sector R&D
Information Services Group
In house and commercial services Library, ERMS, Legal (Freedom of Information and data Protection Acts)
W3 Group
UK& Ireland W3C office, ERCIM, etc.
Who we are: e Who we are: e-
Information
4
FMICS 2003, Roeros, June 2003
Information Systems and Services Information Systems and Services
...
...
...
...
...
5
FMICS 2003, Roeros, June 2003
Information Systems and Services Information Systems and Services
Information Modelling and Analysis
Security and Trust management
Weband Grid Technology
6
FMICS 2003, Roeros, June 2003
Contents Contents
The advert Two areas of research
Modeling Trust in e-Services Semantics of information hiding
Future work
7
FMICS 2003, Roeros, June 2003
(Theo (Theo Dimitrakos Dimitrakos) )
8
FMICS 2003, Roeros, June 2003
“ “The UK is the largest The UK is the largest e e-
commerce market in Europe ... Europe ... Value added Value added in ITEC sectors in ITEC sectors accounts for nearly a accounts for nearly a third of GDP growth” third of GDP growth”
[UK On-line annual report 2000]
9
FMICS 2003, Roeros, June 2003
BUT ... major concern about the trustworthiness of e-Services
"While internet penetration is growing rapidly, all the evidence "While internet penetration is growing rapidly, all the evidence shows that shows that consumer confidence in the e consumer confidence in the e-
commerce medium itself and in cross-
border transactions remains low. transactions remains low. E E-
commerce, therefore, is an insignificant part of final consumption within
the European Union the European Union – – significantly below 1% of total retail sales." significantly below 1% of total retail sales."
[David Byrne, European Commissioner for Health and Consumer Protection]
10
FMICS 2003, Roeros, June 2003
“ “For e
For e-
services to achieve the same levels of acceptance as their conventional counterpart conventional counterpart trust management trust management has to become an intrinsic part of has to become an intrinsic part of e e-
service provision.”
Patricia Hewitt Patricia Hewitt -
UK minister for e-
commerce
“Despite the presence of effective base technologies, there remains a need for further innovation before trust can be managed efficiently managed efficiently at the service level.”
11
FMICS 2003, Roeros, June 2003
12
FMICS 2003, Roeros, June 2003
This period may be in the past (history), the duration of the service (from now and until end of service), future (a scheduled or forecasted critical time slot), or always Dependability is deliberately understood broadly to include
security, safety, reliability, timeliness, maintainability
(following Newcastle the interpretation www.dirc.org.uk)
The measurement may be absolute (e.g. probability) or relative (e.g. dense order) Trust is relative to a specific service. Different trust relationships appear in different business contexts
Trust of a party Trust of a party A
A to a party
to a party B
B for a service
for a service X
X is
is the the measurable belief of measurable belief of A
A in that
in that B
B behaves
behaves dependably for a specified period within a dependably for a specified period within a specified context specified context
13
FMICS 2003, Roeros, June 2003
Subjective beliefs as opinions
(Dempster-Shafer, Theory of evidence) (Josang, Subjective Logic)
(belief,disbelief,uncertainty,atomicity)
b+d+u=1
14
FMICS 2003, Roeros, June 2003
b(p&q) = b(p).b(q) d(p&q) = d(p) + d(q) - d(p).d(q) u(p&q) = b(p).u(q) + u(p).b(q) + u(p).u(q)
b d u b d u
15
FMICS 2003, Roeros, June 2003
wA,B (p) = wA(iB) ⊗
⊗ ⊗ ⊗ wB(p) =
= (b(iB).b(p) , b(iB).d(p) , ...)
iB = “B reliably tells the truth”
wA(p) ⊕
⊕ ⊕ ⊕ wB(p) = ( b1(p).u2(p)+u1(p).b2(p) , ...
u1(p)+u2(p)-u1(p).u2(p)
Independent evidence ( there are alternatives)
16
FMICS 2003, Roeros, June 2003
17
FMICS 2003, Roeros, June 2003
Dependable Dependable
Behaviour Behaviour
Dependable Dependable
Intentions Intentions
Trust Trust
Inclinations Inclinations Trust Management aims to maximise Trust Management aims to maximise trust while minimising risk. trust while minimising risk. The total process of identifying, controlling and minimising the impact of deception and failure in trust. Analyses threats and trust inclinations while supporting the formation of dependable intentions and controlling dependable behaviour.
Trust management subsumes and relies on risk analysis and risk Trust management subsumes and relies on risk analysis and risk management. management.
Security SecurityThreats Threats Safety Safety Threats Threats
Security Risk Management Security Risk Security Risk Management Management Safety Risk Management
[ [other dependability aspects“a unified approach to specifying and interpreting security policies, credentials, relationships [which] allows direct authorization of security-critical actions”
Blaze, Feigenbaum Feigenbaum & Lacy 1998 [ & Lacy 1998 [AT&T
AT&T POLICYMAKER POLICYMAKER]
]
18
FMICS 2003, Roeros, June 2003
Divergence from prescribed behaviour
Divergence from prescribed behaviour
COMPUTER SCIENCE
LEGAL LEGAL REASONING REASONING LOGIC LOGIC
ECONOMICS ECONOMICS & & GAME THEORY GAME THEORY GOGNITIVE GOGNITIVE SCIENCES SCIENCES
TRUST TRUST
19
FMICS 2003, Roeros, June 2003
On the Semantics of Information Hiding On the Semantics of Information Hiding
Do not read this Exploring the role of frames in refinement Non-interference : Component A does not depend on component B
20
FMICS 2003, Roeros, June 2003
On the Semantics of Information Hiding On the Semantics of Information Hiding Motivation
Simple examples of the usefulness of information hiding
Informal Treatment
Three interpretations of “Do not read this”
Formal Semantics
Substitutions with read and write frames
Refinement
“Refinement does not preserve information hiding”
Reflections
Examples revisited, Conclusions, Future work
FMICS 2003, Roeros, June 2003
22
FMICS 2003, Roeros, June 2003
Examples Examples
Is x:=x the same as skip ?
wp(x:=x)P = wp(skip)P Dunne ZB2002>... but x:=x+1||skip not same as x:=x+1||x:=x
Is x:=y-y the same as x:=0 ?
wp(x:=y-y)P = wp(x:=0)P but x:=y-y may not be well formed if y should not be read
semantics which interprets read frames also
23
FMICS 2003, Roeros, June 2003
More Examples More Examples
When is S||T refined by S;T ?
Is x := x a valid initialisation ? (or x := x-x ?)
When does x := y for y : {1,2} refine x :
What refines x:=c for some underspecified constant c:{0,1} ?
When is S
24
FMICS 2003, Roeros, June 2003
Examples Examples
Read frames and Non-interference
When is S||T refined by S;T ? Sufficient: If T does not read any variables written by S
Sematically: If T does not depend on any variables changed by S How is this justified formally ?
FMICS 2003, Roeros, June 2003
26
FMICS 2003, Roeros, June 2003
(F,R,W,S)
F - the frame of all variables in scope R - the subset of F which can be read W - the subset of F which can be written S - the body of the substitution
An operation in 4 An operation in 4 parts parts
27
FMICS 2003, Roeros, June 2003
Will give 4 relational semantics models
MR MW MRW
the usual semantics – no frames
σ σ σ1, σ σ σ σ2):Σ Σ Σ ΣxΣ Σ Σ Σ | ¬[S]¬(σ σ σ σ1=σ σ σ σ2)}
writes only W, reads all – simple
Ξ Ξ ΞF-W
reads only R, writes all – to be defined
= MR
4 4 Semantic models Semantic models
28
FMICS 2003, Roeros, June 2003
write write-
write Semantics Semantics
Write only variables must be written by a value dependent only on reads Initialisation of variables: x := E where x = W and vars E
... but does not combine with MW
σ σ σ1, σ σ σ σ2, σ σ σ σ1’ • σ σ σ σ1Ξ Ξ Ξ ΞRσ σ σ σ2
σ σ σ1MR σ σ σ σ1’
σ σ σ2 MR σ σ σ σ1’
WO RW wo2 wo1 rw
σ σ σ σ1 σ σ σ σ2 σ σ σ σ1’ σ σ σ σ1’
29
FMICS 2003, Roeros, June 2003
write write-
write Semantics Semantics
30
FMICS 2003, Roeros, June 2003
write write-
non-
interference Semantics Semantics
Allows skip and others which do not depend on un-read vars
final values of read variables depend only on read variables no info flow from unread to read
Adding no-change of un-write vars gives non-int result
σ σ σ1, σ σ σ σ2, σ σ σ σ1’ • σ σ σ σ1Ξ Ξ Ξ ΞRσ σ σ σ2
σ σ σ1Mσ σ σ σ2
σ σ σ2’ • σ σ σ σ1’ Ξ Ξ Ξ ΞR σ σ σ σ2’
σ σ σ1’ M σ σ σ σ2’
RW rw WO wo2 wo1
σ σ σ1 σ σ σ σ2 σ σ σ σ1’ σ σ σ σ2’
31
FMICS 2003, Roeros, June 2003
write write-
non-
interference Semantics (cont) Semantics (cont)
MR is largest subrelation of M0 st Ξ
Ξ Ξ ΞR is a bisimulation on MR Ξ Ξ Ξ ΞR ; M
Ξ Ξ ΞR
F-R R
σ σ σ σ1 σ σ σ σ2 σ σ σ σ1’ σ σ σ σ2’ Ξ Ξ Ξ ΞR Ξ Ξ Ξ ΞR M M
32
FMICS 2003, Roeros, June 2003
Termination Termination Semantics Semantics
Ξ Ξ ΞR(|T|)
WO RW
T
FMICS 2003, Roeros, June 2003
34
FMICS 2003, Roeros, June 2003
reads S SW set_writes writes W R
RS
set_reads reads S U reads T reads S U reads T S||T parallel writes S U writes T reads S U reads T S [] T bdd choice writes S U writes T reads S U reads T S ; T sequential writes S vars G U reads S G ==> S guarded writes S vars S U reads S P | S precond {x} vars E x:=E assign { } { } skip skip writes reads subst
Concrete Syntax Concrete Syntax
set_reads (writes) overwrites frame; expands or contracts Do we require R
35
FMICS 2003, Roeros, June 2003
Abstract Syntax Abstract Syntax (F,R,W,S)
F - declares and binds all variables in scope R
W
S - the substitution
36
FMICS 2003, Roeros, June 2003
Semantics Semantics
Define three predicates on (T,M) pairs:
subst(F,R,W,S)(T,M) = T
σ σ σ=σ σ σ σ’) writes (F,R,W,S)(T,M) = M
Ξ Ξ ΞF-W
reads (F,R,W,S)(T,M) = Ξ
Ξ Ξ ΞR(|T|)
Ξ Ξ ΞR;M
Ξ Ξ ΞR
No mention R,W No mention R No mention W
Take all (T,M) pairs which satisfy them:
S = { (T,M) |
subst(F,R,W,S)(T,M)
Take the unique least refined of these:
[[(F,R,W,S)]]0 = ι
ι ι ι (T,M)
T
37
FMICS 2003, Roeros, June 2003
Theorem: Non Theorem: Non-
interference 1
1 2 2 1 2 1 1 2 2 1 2 2 1 1
]] S ; S [[ = ]] S ; S [[ = ]] S || S [[ W R = {} = W R W R W R
... but why require R
... and what about refinement ?
FMICS 2003, Roeros, June 2003
39
FMICS 2003, Roeros, June 2003
Refinement Semantics Refinement Semantics
(F1,R1,W1,S1)
= S1
[[(F,R,W,S)]]0 = (
(T,M)
ditto writes
Refinement with frames “encoded” into op’s semantics
40
FMICS 2003, Roeros, June 2003
Theorem: Non Theorem: Non-
interference 2
Proof requires:
4 frame properties reads(Ri,Mi) and writes(Wi, Mi) non-interference conditions F- W2
read respecting refinement and Ri
For Si = (F,Ri,Wi,si) Ri
R1
Si
———————————— T1 ; T2 = T1 || T2 = T2 ; T1
FMICS 2003, Roeros, June 2003
42
FMICS 2003, Roeros, June 2003
Examples revisited Examples revisited
see last result
eg inv
x=y init ({x,y} , { } , {x,y} , x:=y)
Can we underpin the hiding conditions?
({x}, { }, {x}, x :
new hypotheses in proof rules for refinement ...
43
FMICS 2003, Roeros, June 2003
Examples revisited Examples revisited
strengthen reads and strengthen writes
R1
W1
———————————— ———————————— (F, R1, W, S)
(F, R, W1, S)
reads proof requires: M
Ξ Ξ ΞF-W
Ξ Ξ ΞR1-R2 requires Ri
Strengthen substitution
Ξ Ξ Ξ ΞR (| G |)
—————————————— (F, R, W, S)
proof requires G respects read frame
44
FMICS 2003, Roeros, June 2003
So what about R So what about R
W .... Why needed R
elsewhere reads, writes, and subst orthogonal
Strengthen reads predicate to
reads’(F,R,W,S)(R,M) =
Gives more general form of non-int result....
45
FMICS 2003, Roeros, June 2003
Theorem: non Theorem: non-
interference 3
Proof is “satisfyingly precise”
Details in FME’02 paper
1 2 2 1 1 1 2 2 2 1 i i i i
M ; M = M ; M ) W R ( W = {} = ) W R ( W ) M , W ( writes ) M , R ( ' reads U I U I
FMICS 2003, Roeros, June 2003