Download - Academy Publisher

under the endorsement of both the manager () and
accountant () operations. We encode this policy using
AspectJ language. The code is shown in Fig. 1.
bool pm = false;
aspect Cr
bool pa = false;
{ Pointcut c()}:
……
call (* critical())
manager();
&&target(P);
if(…) { accountant(); } before c()
critical();
if (pm ∧ pa)
{ pm = false; pa = false; }
else throw IRMException();
(a) Base Code
}
aspect Ma
aspect Ac
{ Pointcut m()}:
{ Pointcut a()}:
call (* manager())
call (* accountant())
&&target(P);
&&target(P);
After m() { pm = true;} After a() { pa = true;}
}
}
Figure 1. base code and aspect of example 1
The base code in block (a) is the primary program. It
defines two global variables, pa and pm, and executes
three security-related functions: accountant(), manager()
and critical(). According to the policy, critical() can be
executed only after both accountant() and manager()
have been executed. To execute this policy, we create
three aspects. First, aspect Ma defines Pointcut m, which
is located at the function manager(). The type of advice is
After. Thus, the action defined by aspect Ma is that after
manager() has finished, the variable pm is set to “true”.
Next, aspect Ac is defined similarly to aspect Ma, but sets
pa to true after accountant() has finished. Finally, aspect
Cr defines Pointcut c() at the function critical(). The type
of advice is Before, so the actions defined by aspect Cr
take place before the execution of critical(). The code
fragment evaluates pa and pm; if both are true, it executes
the critical() function and sets pa and pm to false.
Otherwise, it throws an exception.
At compilation, the aspect weaver incorporates all
three aspects into the base code to produce a AOSM.
Figure 2 displays the code for the resulting program.
……
manager();
pm = true;
if(…) {accountant();
pa = true;}
if (pm ∧ pa)
{ pm = false; pa = false;
critical();}
else throw new IRMException();
Figure 2. Policy-adherence program after Aspect weaving
III. CORRECT VERIFICATION MODEL FOR
AOSM PROGRAM
Based on the characteristics of AOSM programs, we
construct a verification model to verify the correct
property of monitor inlined programs.
A. Abstract structure
Alternating-Time Temporal Logic (ATL) and
Alternating Transition System (ATS) [7, 8] are logical
specification tools for open system. We specify an
AOSM program as a Turn-Based Alternating Transition
System (Turn-based ATS). The concrete definition given
as follows:
Definition 3.1 An AOSM program structure (AOSM
structure ) can be abstracted as a Turn-based ATS.
Expressed as tuple AOSM Structure=
with the follow components:
1. ∑ is a set of players, which includes system
components Aspect and BaseCode, as well as
Environment.
2. Q is a finite set of state;
3. ∏ is a finite set of proposition;
4. Function π :Q→2∏ is a labeling function, which
maps each state q∈Q to a set π (q) ⊆ ∏. π (q) is
the set of propositions true at state q.
5. Function σ: Q→ ∑ map a state q to a player aq.
Representing that at state q, it is the turn of player aq
to choose the next execution steps of program. Nature
number da(q)≥1 is moves available at state q for
player a. We identify the moves of player a at state q
with the numbers 1,……,da(q). For each state q∈Q, a
move vector at q is a tuple < j1; : : : ; jk> such that 1
≤ja≤da(q) for each player a. For other players b∈∑\
aq at state q, db(q)=1;
6. δ(q, J a ) is a transition function. When a q choose
action j a , the state will transit to next state q`=δ(q, J a )
∈Q.
B. Defination of correct property
We now describe soundness and transparency
properties in ATL formulas in this section. So it needs to
interpret the syntax of ATL at first:
Definition 3.2 An ATL formula is one of the following:
1. Proposition p,P∈∏;
2. ¬ ϕ or ϕ 1∨ϕ 2, where ϕ 、ϕ 1、ϕ 2 are ATL
formulas;
3. ○ ϕ , or □ ϕ , or ◇ ϕ , or
ϕ 1 uϕ 2 are ATL formulas, where A ⊆ ∑is
a set of players, and ϕ 、 ϕ 1 and ϕ 2 are ATL
formulas.
The operator is path quantifier, and ○(“next”),
□(“always”), ◇ (“eventually”), and U (“until”) are
temporal operators. represent path chosen by
players in set A. Quantifieralso has a dual form
〖〗. While formalsϕ means that the players in
A can cooperate to make the ϕ true, the dual form
〖A〗ϕ means that the players in A can not cooperate
to make the ϕ false.
Based on above definitions of ATL, we now
formulate the correct property of self-monitoring program
on AOSM structure.
Definition 3.3 (Soundness) Soundness means that the
self-monitoring program should adhere to the intended
policy. That is to say, on an AOSM structure, all the path
decided by the strategies of players Aspect and BaseCode
should satisfy the charactersϕ of policy, no matter how
121