A Formal Framework for specifying and Analyzing Liabilities Using Log as Digital Evidence. (Un cadre formel pour spécifier et analyser les responsabilités, basé sur les logs comme preuve électronique)

Despite the e ort made to de ne methods for the design of high quality software, experience shows that failures of IT systems due to software errors remain very common and one must admit that even critical systems are not immune from that type of errors. One of the reasons for this situation is that software requirements are generally hard to elicit precisely and it is often impossible to predict all the contexts in which software products will actually be used. Considering the interests at stake, it is therefore of prime importance to be able to establish liabilities when damages are caused by software errors. Essential requirements to de ne these liabilities are (1) the availability of reliable evidence, (2) a clear de nition of the expected behaviors of the components of the system and (3) the agreement between the parties with respect to liabilities. In this thesis, we address these problems and propose a formal framework to precisely specify and establish liabilities in a software contract. This framework can be used to assist the parties both in the drafting phase of the contract and in the de nition of the architecture to collect evidence. Our rst contribution is a method for the integration of a formal de nition of digital evidence and liabilities in a legal contract. Digital evidence is based on distributed execution logs produced by "acceptable log architectures". The notion of acceptability relies on a formal threat model based on the set of potential claims. Another main contribution is the de nition of an incremental procedure, which is implemented in the LAPRO tool, for the analysis of distributed logs.