Modeling and Analysis of Security Protocols Using Role Based Specifications and Petri Nets

Recent technologies have cleared the way for large scale application of electronic communication. The open and distributed nature of these communications implies that the communication medium is no longer completely controlled by the communicating parties. As a result, there has been an increasing demand for research in establishing secure communications over insecure networks, by means of security protocols. In this thesis, a formal model for the description and analysis of security protocols at the process level is developed. At this level, under the assumption of perfect cryptography, the analysis focusses on detecting aws and vulnerabilities of the security protocol. Starting from ??rst principles, operational semantics are developed to describe security protocols and their behaviour. The resulting model is parameterized, and can e.g. capture various intruder models, ranging from a secure network with no intruder, to the strongest intruder model known in literature. Within the security protocol model various security properties are de??ned, such as secrecy and various forms of authentication. A number of new results about these properties are formulated and proven correct. Based on the model, an automated veri??cation procedure is developed, which signi ??cantly improves over existing methods. The procedure is implemented in a prototype, which outperforms other tools. Both the theory and tool are applied in two novel case studies. Using the tool prototype, new results are established in the area of protocol composition, leading to the discovery of a class of previously undetected attacks. Furthermore, a new protocol in the area of multiparty authentication is developed. The resulting protocol is proven correct within the framework.

When designing complex systems, mechanisms for structuring, composing, and reusing system components are crucial. Today, there are many approaches for equipping Petri nets with such mechanisms. In the context of defining a standard interchange format for Petri nets, modular PNML was defined as a mechanism for modules in Petri nets that is independent from a particular version of Petri nets and that can mimic many composition mechanisms by a simple import and export concept. Due to its generality, the semantics of modular PNML was only informally defined. Moreover, modular PNML did not define which concepts could or should be subject to import and export in high-level Petri nets. In this paper, we formalise a minimal version of modular high-level Petri nets, which is based on the concepts of modular PNML. This shows that modular PNML can be formalised once a specific version of Petri net is fixed. Moreover, we present and discuss some more advanced features of modular Petri nets that could be included in the standard. This way, we provide a formal foundation and a basis for a discussion of features to be included in the upcoming standard of a module concept for Petri nets in general and for high-level nets in particular.

The work described in this paper is concerned with modeling and analysing distributed object-oriented real time (RT) systems, developed according to DART — Distributed Architecture for Real Time — which provides an object-oriented life cycle for RT systems. The paper first gives an overview of DART, then discusses the usefulness of mapping DART systems onto high level Petri nets as part of an iterative design process. The resultant framework is a modular operational model, based on a powerful Petri nets tool which delivers both the user-interface utilised for animation purposes and a set of mechanisms suited for the analysis of time-dependent behaviour.Keywordsreal timescheduling analysisdistributed systemsobject-orientationPetri netsanimationexecutable specifications

With the rise of the Internet and other open networks, a large number of security protocols have been developed and deployed in order to provide secure communication. The analysis of such security protocols has turned out to be extremely difficult for humans, as witnessed by the fact that many protocols were found to be flawed after deployment. This has driven the research in formal analysis of security protocols. Unfortunately, there are no effective approaches yet for constructing correct and efficient protocols, and work on concise formal logics that might allow one to easily prove that a protocol is correct in a formal model, is still ongoing. The most effective approach so far has been automated falsification or verification of such protocols with state-of-the-art tools such as ProVerif [1] or the Avispa tools [2]. These tools have shown to be effective at finding attacks on protocols (Avispa) or establishing correctness of protocols (ProVerif).KeywordsOperational SemanticSecurity ProtocolAttack TraceComputer Security Foundation WorkshopSecurity ClaimThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

Place/transition Petri nets are a standard model for a class of distributed systems whose reachability spaces might be infinite. One of well-studied topics is verification of safety and liveness properties in this model; despite an extensive research effort, some basic problems remain open, which is exemplified by the complexity status of the reachability problem that is still not fully clarified. The liveness problems are known to be closely related to the reachability problem, and various structural properties of nets that are related to liveness have been studied. Somewhat surprisingly, the decidability status of the problem of determining whether a net is structurally live, i.e. whether there is an initial marking for which it is live, remained open for some time; e.g. Best and Esparza (Inf Process Lett 116(6):423–427, 2016. https://doi.org/10.1016/j.ipl.2016.01.011 ) emphasize this open question. Here we show that the structural liveness problem for Petri nets is ExpSpace-hard and decidable. In particular, given a net N and a semilinear set S, it is decidable whether there is an initial marking of N for which the reachability set is included in S; this is based on results by Leroux (28th annual ACM/IEEE symposium on logic in computer science, LICS 2013, New Orleans, LA, USA, June 25–28, 2013, IEEE Computer Society, pp 23–32, 2013. https://doi.org/10.1109/LICS.2013.7 ).

Reconfigurable systems have received much attention from academia and industry because they are efficient, agile, and reasonably priced, and they are the trend of all future systems. The chapter focuses on dynamic automatic reconfigurations of Control Systems to be classically modeled by Petri nets. Several modeling and verification methods for such systems are shown and compared before the introduction of the research work on feasible dynamic reconfigurations and the implementation of manufacturing systems based on Petri nets. Three different reconfiguration scenarios can be applied at run-time to such systems: Addition/Removal of places, Addition/Removal/Update of transitions, or finally, the simple modification of the initial marking. Three formal modules are defined accordingly, which allow the reconfigurations of the system’s Petri nets model: the first module to dynamically change places of the model, the second to dynamically reconfigure transitions within a given subset of places, and the third to modify the initial markings of places. To check the correct behavior of this architecture according to user requirements, the model checker SESA is applied for the verification of CTL-based properties of the proposed modules and also of the system. The contribution is applied to a real-world Benchmark Production System.

It is more difficult to model a discrete system than a continuous system. Recently, a great number of applications of Petri nets to the design and the analysis of discrete systems has been reported. However, a common problem in its applications is that the required computer memories and the computation times increase explosively in accordance with the increase in the number of systems components. Some methods to divide or to reduce Petri nets have been proposed to solve this problem. Although the liveness and boundedness of Petri nets are held in the divided or reduced Petri nets, the reachability problem cannot be solved by these methods.This paper proposes another method to model discrete systems by Petri nets with place invariants. A sequential control system will be described as a typical kind of discrete system, and its structural characteristics will be used in modeling. Each component of a sequential control system will be modeled by a sub‐Petri net with place invariants. There are many components in one sequential control system, but not each one is necessarily complicated. Most sub‐Petri nets do not have so many places or transitions. It is also well known that a Petri net with place invariants is bounded and can be live by placing sufficient tokens into its initial marking. Besides, the reachability problem is not so difficult to solve in a small sub‐Petri net. Further, an activating relation to combine two or more sub‐Petri nets is defined, and some rules to reduce conflicts among enabled transitions will be described for simulations.

Petri net (PN), as a kind of powerful modeling tool for discrete-event dynamic systems, has widely applied in many domains. In this paper, two classes of high-level PN, controlled colored Petri net and controlled hybrid Petri net, are proposed and applied in the unit-commitment (UC) problem for a regional power grid with pumped storage stations. At the same time, the principle of large-scale system decomposition-coordination is applied to solve the problem of optimizing system operation. As a result, the UC problem is further simplified, as well as the algorithm efficiency improved. The proposed solution based on the high-level PN models, dynamic programming and decomposition-coordination theory, provides a new modeling methodology and could result in a superior dispatch plan for a regional power grid. (6 pages)

High level Petri nets (HLPNs) have been widely applied to model concurrent and distributed systems in computer science and many other engineering disciplines. However, due to the expressive power of HLPNs, they are difficult to analyze. In recent years, a variety of new analysis techniques based on model checking have been proposed to analyze high level Petri nets in addition to the traditional analysis techniques such as simulation and reachability (coverability) tree. These new analysis techniques include (1) developing tailored model checkers for particular types of HLPNs or (2) leveraging existing general model checkers through model translation where a HLPN is transformed into an equivalent form suitable for the target model checker. In this paper, we present a term rewriting approach to analyze a particular type of HLPNs -- predicate transition nets (PrT nets). Our approach is completely automatic and implemented in our tool environment, where the frontend is PIPE+, a general graphical editor for creating PrT net models, and the backend is Maude, a well-known term rewriting system. We have applied our approach to the Mondex system -- the 1st pilot project of verified software repository in the worldwide software verification grand challenge, and several well-known problems used in the annual model checking contest of Petri net tools. Our initial experimental results are encouraging and demonstrate the usefulness of the approach.

A problem for hypertext-based learning application is to control learning paths for different learning activities. This paper first introduces related concepts of hypertext learning state space and high level Petri Nets (PNs), then proposes a high level timed PN based approach used to providing kinds of adaptation for learning activities by adjusting time attributes of targeted learning state space. Examples are given while explaining ways to realising adaptive instructions. Possible future directions are also discussed at the end of this paper.

This paper is concerned with elementary and high-level Petri nets (coloured Petri nets and predicate/transition nets) and their utility for conceptual modeling of information systems. Particular features of existing net classes are discussed and additional net constructs are proposed for that purpose. Adequate conceptual models, i.e., models which reflect an intended view of an information system without any strange or artifical elements are best obtained if the following features are available to the modeler: (i) places have finite capacities (bounded places), (ii) arc expressions denote sets of variable cardinality, (iii) exclusive and shared use of side-conditions can be specified, (iv) terms denoting the set of all entities of a current marking or a specified subset thereof can be used in transition expressions, (v) static properties can be specified in state-oriented terms and impose restrictions on the dynamic properties specified in transition-oriented terms. The paper presents examples of each one of these desirables features and discusses them against the existing high-level Petri net classes or shows how they can be provided without resorting to so-called extensions.

CORBA is a standard proposed by the Object Management Group (OMG) that promotes interoperability between distributed object systems. Following the standardization of this object-oriented middleware, the OMG has specified a set of Common Object Services (COS) that are meant to serve as the building blocks of distributed CORBA applications. The COSes are specified using CORBA Interface Definition Language (IDL), that describes the syntactic aspects of services supported by remote objects. However, CORBA-IDL does not support specification of the behaviour of objects in an abstract and formal way, and behavioural specification is mostly provided in plain English. To overcome this problem, we have proposed a formal description technique (Cooperative Objects) based on high-level Petri nets, and developed a software support environment. The goal of this paper is to demonstrate that our approach is suited to the formal specification of typical CORBA COS, and presents a Cooperative Object model of the CORBA event service, a COS that provides asynchronous, one-to-many communication between objects. The advantages of dealing with a tool-supported, executable formal notation are detailed, as well as the results that can be obtained through Petri net analysis techniques.Key wordsDistributed systemsbehavioural specificationCORBAhigh-level Petri nets

This paper aims at showing how it is possible to combine the advantages of high-level Petri nets and the B method in order to design safety applications. In the railway critical software domain, safety requirements are obviously severe. Indeed, the passing from an informal specification to a formal one is a crucial point in critical software development. High-level Petri nets combine three important features: a graphical representation, a dynamic behavior and an abstraction of the treatments. The B method allows one to pass from an abstract specification to a concrete implementation. The paper proposes an approach that integrates the structuring and modeling of the system behavior by means of colored Petri nets from semi-formal specifications and the generation of a B abstract specification from this Petri net.

Formalization of process behavior is a key issue for semantic Web services. However, this bears the disadvantage of clumsy specifications. In this paper we introduce a Petri net based approach to capture the semantics of Web services. It offers a visual modeling technique and means of refinement and composition. The model is very formal allowing for a clear specification of the semantics a process has. We combine ideas from the Petri net community with ideas from the description logic area focusing on ontologies

The author presents a tutorial on high-level Petri nets and their applications. The author illustrates the transition firing rule of a high-level Petri net using an example. A high-level net can be considered as a structurally folded version of a regular Petri net, if the number of colors is finite. Thus, a high-level net can be unfolded into a regular Petri net by unfolding each place p into a set of places, one for each color of tokens which p may hold, and by unfolding each transition t into a set of transitions, one for each way that t may fire. The author informally introduces high-level nets through examples. The examples are taken from recent applications of high-level Petri nets to : (1) Horn clause logic programs, (2) four-valued annotated predicate logic, (3) nonmonotonic logic and (4) robot planning.< <ETX xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">&gt;</ETX>