Formal Safety and Security Assessment of an Avionic Architecture with Alloy

Abstract

We propose an approach based on Alloy to formally model and assess a system architecture with respect to safety and security requirements. We illustrate this approach by considering as a case study an avionic system developed by Thales, which provides guidance to aircraft. We show how to define in Alloy a metamodel of avionic architectures with a focus on failure propagations. We then express the specific architecture of the case study in Alloy. Finally, we express and check properties that refer to the robustness of the architecture to failures and attacks.

Safety and Security Assessment of Behavioral Properties Using Alloy

“…In this work, the security aspects are not developed (we have just considered three threats that have the same kind of effects as failures). However, recent works have showed the relevance of Alloy to assess more advanced security properties [10,11,6]. Moreover, it was shown that using AltaRica, one can specify the effect of richer security threats over a system architecture [2] and check related security properties.…”

“…Alloy has recently been used in the context of security assessment, for instance to model JVM security constraints [11], access control policies [12], or attacks in cryptographic protocols [10]. Besides, we proposed in earlier works a study of the safety and security assessment of an avionic system supporting an approach procedure [4,5,6].…”

Evaluating the suitability of state‐based formal methods for industrial deployment

“…Alloy does support multiple levels of abstraction as well as recursively defined relations but not recursive functions. Concurrent systems can be modeled in Alloy (see, eg, the work of Brunel et al). As Alloy is based on relational logic and relational calculus, nondeterminism is already present .…”

“…On the other hand, this can be much more powerful than most explicit mechanisms, because one can write a fully relational postcondition, which is not possible in many other methods. Alloy has been used for designing systems where global system properties of correctness , such as safety, security, and reliability, have played an important role (see, eg, the work of Brunel et al). Alloy has no direct notion of time .…”

Over 20 years of research into cybersecurity and safety engineering: a short bibliography

“…If the major part of the paper contributions relates to adaptations, there are also some novel and/or disruptive approaches, e.g. Sommerville [41], Olive et al [42], Knorreck and Apvrille [43], Pedroza et al [44], Apvrille and Roudier [45] and Brunel et al [46,47].…”