62,647 research outputs found
Validating a Web Service Security Abstraction by Typing
An XML web service is, to a first approximation, an RPC service in which
requests and responses are encoded in XML as SOAP envelopes, and transported
over HTTP. We consider the problem of authenticating requests and responses at
the SOAP-level, rather than relying on transport-level security. We propose a
security abstraction, inspired by earlier work on secure RPC, in which the
methods exported by a web service are annotated with one of three security
levels: none, authenticated, or both authenticated and encrypted. We model our
abstraction as an object calculus with primitives for defining and calling web
services. We describe the semantics of our object calculus by translating to a
lower-level language with primitives for message passing and cryptography. To
validate our semantics, we embed correspondence assertions that specify the
correct authentication of requests and responses. By appeal to the type theory
for cryptographic protocols of Gordon and Jeffrey's Cryptyc, we verify the
correspondence assertions simply by typing. Finally, we describe an
implementation of our semantics via custom SOAP headers.Comment: 44 pages. A preliminary version appears in the Proceedings of the
Workshop on XML Security 2002, pp. 18-29, November 200
A Polynomial Translation of pi-calculus FCPs to Safe Petri Nets
We develop a polynomial translation from finite control pi-calculus processes
to safe low-level Petri nets. To our knowledge, this is the first such
translation. It is natural in that there is a close correspondence between the
control flows, enjoys a bisimulation result, and is suitable for practical
model checking.Comment: To appear in special issue on best papers of CONCUR'12 of Logical
Methods in Computer Scienc
Supporting user-oriented analysis for multi-view domain-specific visual languages
This is the post-print version of the final paper published in Information and Software Technology. The published article is available from the link below. Changes resulting from the publishing process, such as peer review, editing, corrections, structural formatting, and other quality control mechanisms may not be reflected in this document. Changes may have been made to this work since it was submitted for publication. Copyright @ 2008 Elsevier B.V.The integration of usable and flexible analysis support in modelling environments is a key success factor in Model-Driven Development. In this paradigm, models are the core asset from which code is automatically generated, and thus ensuring model correctness is a fundamental quality control activity. For this purpose, a common approach is to transform the system models into formal semantic domains for verification. However, if the analysis results are not shown in a proper way to the end-user (e.g. in terms of the original language) they may become useless.
In this paper we present a novel DSVL called BaVeL that facilitates the flexible annotation of verification results obtained in semantic domains to different formats, including the context of the original language. BaVeL is used in combination with a consistency framework, providing support for all steps in a verification process: acquisition of additional input data, transformation of the system models into semantic domains, verification, and flexible annotation of analysis results.
The approach has been validated analytically by the cognitive dimensions framework, and empirically by its implementation and application to several DSVLs. Here we present a case study of a notation in the area of Digital Libraries, where the analysis is performed by transformations into Petri nets and a process algebra.Spanish Ministry of Education and Science and MODUWEB
Trustworthy Refactoring via Decomposition and Schemes: A Complex Case Study
Widely used complex code refactoring tools lack a solid reasoning about the
correctness of the transformations they implement, whilst interest in proven
correct refactoring is ever increasing as only formal verification can provide
true confidence in applying tool-automated refactoring to industrial-scale
code. By using our strategic rewriting based refactoring specification
language, we present the decomposition of a complex transformation into smaller
steps that can be expressed as instances of refactoring schemes, then we
demonstrate the semi-automatic formal verification of the components based on a
theoretical understanding of the semantics of the programming language. The
extensible and verifiable refactoring definitions can be executed in our
interpreter built on top of a static analyser framework.Comment: In Proceedings VPT 2017, arXiv:1708.0688
Edit and verify
Automated theorem provers are used in extended static checking, where they
are the performance bottleneck. Extended static checkers are run typically
after incremental changes to the code. We propose to exploit this usage pattern
to improve performance. We present two approaches of how to do so and a full
solution
Recommended from our members
Graph models for reachability analysis of concurrent programs
Reachability analysis is an attractive technique for analysis of concurrent programs because it is simple and relatively straightforward to automate, and can be used in conjunction with model-checking procedures to check for application-specific as well as general properties. Several techniques have been proposed differing mainly on the model used; some of these propose the use of flowgraph based models, some others of Petri nets.This paper addresses the question: What essential difference does it make, if any, what sort of finite-state model we extract from program texts for purposes of reachability analysis? How do they differ in expressive power, decision power, or accuracy? Since each is intended to model synchronization structure while abstracting away other features, one would expect them to be roughly equivalent.We confirm that there is no essential semantic difference between the most well known models proposed in the literature by providing algorithms for translation among these models. This implies that the choice of model rests on other factors, including convenience and efficiency.Since combinatorial explosion is the primary impediment to application of reachability analysis, a particular concern in choosing a model is facilitating divide-and-conquer analysis of large programs. Recently, much interest in finite-state verification systems has centered on algebraic theories of concurrency. Yeh and Young have exploited algebraic structure to decompose reachability analysis based on a flowgraph model. The semantic equivalence of graph and Petri net based models suggests that one ought to be able to apply a similar strategy for decomposing Petri nets. We show this is indeed possible through application of category theory
- …