— Unpublished Draft — Development of Formal Models for Secure E-services

ion + refinement formalisation Figure 2: Different levels of specification To be able to prove required properties, an appropriate abstraction level must be chosen, so that a verification of the relevant functional and security properties is still possible. The behaviour of formal models at different abstraction levels can be compared using appropriate homomorphisms. In refinements of the model, where a complete analysis is not possible for complexity reasons, interesting parts of the search space can still be explored by manual control using simulation mode. Different models of possible attackers can be included in the specification and the combined model is then explored to find states where an attack succeeds. Figure 3 shows the steps proposed for the development of an executable formal model for an e-service application that works as expected for average usage and is robust under attack conditions.