Analyzing Network Management Effects with SPIN and cTLA

Abstract

Abstract:Since many security incidents of networked computing infrastructures arise from inadequate technical management actions, we aim at a method supporting the formal analysis of those implications which administration activities rnay have towards system security. We apply the specification language cTLA which supports the modular description ofprocess systems and facilitates the construction of a modeling framework. The framework defines a generic modeling structure and provides re-usable model elements. Due to cTLA 's connection to the temporal logic of actions TLA, formal analysis can resort to symbolic reasoning. Supplementarily, automated analysis can be applied. We focus here on automated analysis. It is supported by translation of cTLA specifications into suitable model descriptions for the powernd model checking tool SPIN. We outline the utilized methods and tools, and report on the modeling and SPIN-based analysis ofIP-Hijacking.

Contracts for Multi-instance UML Activities

“…We therefore plan to also formalize our semantics in Promela, so we can use the Spin [8] model checker, which implements partial order reduction. The formalisms are compatible, as there is already work for transforming another TLA derivative, cTLA, into Promela automatically [20]. For relatively simple blocks, where the contract must be verified for any number of instances, the TLA formalism allows for writing manual refinement proofs as well [16].…”

A Framework Based Approach for Formal Modeling and Analysis of Multi-level Attacks in Computer Networks

“…Explicit notions of modules, process types and composition of process types [HK00] are added, however. The following section gives a short overview of the cTLA 2003 process types, a more detailed description is contained in [RK03].…”

“…If a process does not contribute to a system action, it performs a stuttering step. In cTLA 2003 [RK03] process stuttering steps do not have to be explicitly listed on the right hand side of system actions.…”

“…We successfully applied a preliminary version of our approach to the analysis of low-level ARP attacks and administrator actions in a single LAN scenario [RPK04]. When starting with larger and more complex examples we, however, experienced high model development efforts.…”