Lignopolymers As Viscosity-Reducing Additives in Magnesium Oxide Suspensions

Lignopolymers are a new class of polymer additives with the capability to be used as dispersants in cementitious pastes. Made with kraft lignin cores and grafted polymer side- chains, the custom-synthesized lignopolymers were examined in terms of the molecular architecture for viscosity reducing potential in inert model suspensions. Lignin-poly(acrylic acid) (LPAA) and lignin-polyacrylamide (LPAm) have been found to vary the rheology of magnesium oxide (MgO) suspensions based on differences in chain architecture and particle- polymer interactions. A commercial comb-polymer polycarboxylate ester was compared to LPAA and LPAm at 2.7 mg/mL, a typical dosage for cement admixtures, as well as 0.25 mg/mL. It was found that LPAm was a more effective viscosity reducer than both LPAA and the commercial additive at low concentrations, which was attributed to greater adsorption on the MgO particle surface and increased steric dispersion from PAm side-chain extension. The influence of chain adsorption and grafted side-chain molecular weight on rheology was also tested

Efficient design and evaluation of countermeasures against fault attacks using formal verification

This paper presents a formal verification framework and tool that evaluates the robustness of software countermeasures against fault-injection attacks. By modeling reference assembly code and its protected variant as automata, the framework can generate a set of equations for an SMT solver, the solutions of which represent possible attack paths. Using the tool we developed, we evaluated the robustness of state-of-the-art countermeasures against fault injection attacks. Based on insights gathered from this evaluation, we analyze any remaining weaknesses and propose applications of these countermeasures that are more robust

An Access Control Model Based Testing Approach for Smart Card Applications: Results of the {POSÉ} Project

International audienceThis paper is about generating security tests from the Common Criteria expression of a security policy, in addition to functional tests previously generated by a model-based testing approach. The method that we present re-uses the functional model and the concretization layer developed for the functional testing, and relies on an additional security policy model. We discuss how to produce the security policy model from a Common Criteria security target. We propose to compute the tests by using some test purposes as guides for the tests to be extracted from the models. We see a test purpose as the combination of a security property and a test need issued from the know-how of a security engineer. We propose a language based on regular expressions for the expression of such test purposes. We illustrate our approach by means of the IAS case study, a smart card application dedicated to the operations of Identification, Authentication and electronic Signature

An Access Control Model Based Testing Approach for Smart Card Applications: Results of the {POSÉ} Project

International audienceThis paper is about generating security tests from the Common Criteria expression of a security policy, in addition to functional tests previously generated by a model-based testing approach. The method that we present re-uses the functional model and the concretization layer developed for the functional testing, and relies on an additional security policy model. We discuss how to produce the security policy model from a Common Criteria security target. We propose to compute the tests by using some test purposes as guides for the tests to be extracted from the models. We see a test purpose as the combination of a security property and a test need issued from the know-how of a security engineer. We propose a language based on regular expressions for the expression of such test purposes. We illustrate our approach by means of the IAS case study, a smart card application dedicated to the operations of Identification, Authentication and electronic Signature

How functional programming mattered

In 1989 when functional programming was still considered a niche topic, Hughes wrote a visionary paper arguing convincingly ‘why functional programming matters’. More than two decades have passed. Has functional programming really mattered? Our answer is a resounding ‘Yes!’. Functional programming is now at the forefront of a new generation of programming technologies, and enjoying increasing popularity and influence. In this paper, we review the impact of functional programming, focusing on how it has changed the way we may construct programs, the way we may verify programs, and fundamentally the way we may think about programs

A Framework for Verifying Data-Centric Protocols

International audienceData centric languages, such as recursive rule based languages, have been proposed to program distributed applications over networks. They simplify greatly the code, while still admitting efficient distributed execution. We show that they also provide a promising approach to the verification of distributed protocols, thanks to their data centric orientation, which allows us to explicitly handle global structures such as the topology of the network. We consider a framework using an original formalization in the Coq proof assistant of a distributed computation model based on message passing with either synchronous or asynchronous behavior. The declarative rules of the Netlog language for specifying distributed protocols and the virtual machines for evaluating these rules are encoded in Coq as well. We consider as a case study tree protocols, and show how this framework enables us to formally verify them in both the asynchronous and synchronous setting

Load Time Code Validation for Mobile Phone Java Cards

Over-the-air (OTA) application installation and updates have become a common experience for many end-users of mobile phones. In contrast, OTA updates for applications on the secure elements (such as smart cards) are still hindered by the challenging hardware and certification requirements. The paper describes a security framework for Java Card-based secure element applications. Each application can declare a set of services it provides and a set of services it wishes to call, and its own security policy. An on-card checker verifies compliance and enforces the policy; thus an off-card validation of the application is no longer required. The framework has been optimized in order to be integrated with the run-time environment embedded into a concrete card. This integration has been tried and tested by a smart card manufacturer. In this paper we present the formal security model of the approach, its overall architecture and the implementation footprint which can fit on a real secure element. We also report the lessons learned and the intricacies of integrating a research prototype with a protected loader of the manufacturer

A formal proof of a protocol for communications over faulty channels using the Larch Prover

This paper describes, by means of an example, how one may mechanically verify concurrent programs on the automated theorem prover Lp. It presents a fully computer checked proof of a protocol for communications over faulty channels. The chosen specification environment is Unity, since the proposed model can be fruitfully applied to a wide variety of problems and modified or extended for special purposes. It provides a higher level of abstraction to express solutions to parallel programming problems. We investigate how the Unity methodology can be mechanized in Lp, and how we can use the theorem proving methodology to prove safety and liveness

Formal Verification of Concurrent programs: How to specify UNITY using the Larch Prover

This paper describes the use of the Larch Prover to verify concurrent programs. The chosen specification environment is Unity, because it provides a higher level of abstraction to express solutions to parallel programming problems. We investigate how the syntax and the semantic of Unity can be mechanized in LP, a theorem prover designed to check and reason about algebraic specifications, and how we can use the theorem proving methodology to prove safety and livenes

Vérification formelle des systèmes parallèles décrits en UNITY à l'aide d'un outil de démonstration automatique

Non disponible / Not availableCette thèse est consacrée à l'utilisation des méthodes formelles de spécification et de vérification dans le cadre des techniques déductives basées sur la preuve de théorèmes. En particulier, nous nous intéressons à la spécification et à la vérification mécanique de programmes parallèles décrits en UNITY à l'aide du démonstrateur du LARCH, LP. Nous décrivons la formalisation et la mécanisation de la logique et de la méthodologie d'UNITY à l'aide d'un outil de démonstration automatique du premier ordre et à large spectre tel que LP et à leur mise en oeuvre dans des exemples utiles et conséquents. Nous formalisons dans un premier temps la syntaxe et la sémantique d'UNITY dans l'environnement de LP en choisissant comme outil formel la plus faible pré-condition introduite par Dijkstra. Cette modélisation comprend la représentation syntaxique concrète des objets prédicats, de la notation de programmation et des prédicats temporels de UNITY dans une logique du premier ordre. Nous décrivons la construction et la validation d'une base de faits basée sur l'approche des spécifications LSL. Nous proposons une méthodologie de preuve incrémentale basée sur l'utilisation d'un démonstrateur pour la vérification mécanisée dans le but à la fois d'aider à la mise au point des preuves et à la réutilisation des preuves. Nous illustrons l'approche proposée à l'aide de trois études de cas. La vérification formelle mécanique d'un protocole de communication à travers des canaux défectueux met en évidence la méthodologie utilisée pour montrer des propriétés de sûreté et de vivacité et comment un démonstrateur peut être effectivement utilisé pour détecter des failles dans la spécification. La vérification du problème des lecteurs rédacteurs illustre un aspect important dans l'utilisation des démonstrateurs, à savoir la réutilisation et la mécanisation des preuves. Enfin, la vérification d'un protocole de contrôle d'un ascenseur permet de comparer notre approche à celle utilisée avec le démonstrateur d'ordre supérieur HO