Towards a Formal Analysis of Control Systems

Electronic commerce became a buzzword when electronic networks gained popularity, in particular of course due to the in-ternet. The security problem increases rapidly now that computer systems become more open. Most research on electronic commerce, and electronic data interchange in general, has focussed on technical instead of organizational problems, such as value added networks, trusted third parties, chip cards, electronic signatures, etc. Computer science has been pushing technology. However, these technical issues are not the bottleneck for acceptance of these new technologies. Success factors of introducing electronic commerce are solutions of the organizational problems, and the closely related legal issues. Formal models of electronic commerce represent and reason about security policies 4], for example for fraud detection and prevention. Computer security can be based on cryptography , architectures or regulations. For example, to protect a le in a database from unauthorized access it can be encoded , or access can be restricted by special architectures or by regulations. Recent interest in security logics 2] shows how computer science can also contribute to the third category. In this paper we discuss a formal representation of control systems involving a number of independent agents, as they occur in e.g. business and trade procedures. The formal model is based on a division of the information into factual, epistemic and deontic knowledge, and the organisation of control systems into a hierarchy. The classiication of these routines in diierent levels helps the user to audit procedures (for inter-organizational 3] and intra-organizational 1] procedures), analyze scenarios and design secure procedures 7]. We also give an example from international trade, and we discuss the use of the formal model. 1 Towards a formal model We claim that a formal model of control systems should distinguish between three diierent types of knowledge in information systems, and that it should be based on a decomposition of the information system. The formal model can check whether a control system covers all potential fraud situations and thus can be used to design and verify such a system. In Deenition 1 a devision is made between what is factually the case (as observed by the agents), what agents believe to be the case (due to messages the agents receive), and what ought to be the case (as speciied in a contractual agreement between agents). The agents can lie to each other, and as a result they can believe what is factually false. …