Evaluación de la calidad del software

In the previous chapters, we interpreted the endomorphisms of the quantale, that is thef_AQmaps as the appearance of agents about an action. In the security setting, we read these maps assuspicions that each agent has about the messages he sends or receives. For examplef_AQ(q) stands for all the actions agentAsuspects that could have happened whereqis the action that has really happened. As before the adjoints to these maps stand forknowledge of agents about actions. The adjunction equations below

f_AQ(q)≤q0 q≤2Q_Aq0

will now reads as ‘ifA’s suspicions about actionqare more deterministic than actionq0thenqis more deterministic thanA’s knowledge about action q0 and vise-versa’. This reading is not very intuitive. We can re-read it as ‘if when (or after)qhappens, agentAsuspectsthatq0has happened, then when (or after)q happens, agentAknowsthatq0 has happened and vice versa. As before, two consequences of this adjunction are

(1) f_AQ(2Q_Aq)≤q and (2) q ≤2Q_Af_AQ(q)

The first one says that whenAknows that q, he also suspects thatq. The second one says that after actionq, agentA knows all of his suspicions about q. This second consequence is used to express knowledge of agents after a series of messages have been passed in a security protocol.

We have to assign suspicions to the send and receive actions for each agent, that is suspicions of the sender about the send and receive actions and also suspicions of the receiver about the send and receive actions. From these four groups, the following two are the important ones

1. Suspicions of a sender about the receive of the content of his message in his name

2. Suspicions of a receiver about the originality of the content and the name of the claimed sender of the received message.

The other two groups are identities, since sender is sure about his send action and similarly the receiver has no doubts about his receive actions. But they both have suspicions about the corresponding actions of the other party.

When agentAsends a message containing propositionmto agentB, we assume that he suspects the following five things about the receive of his message by agentB:

1. He suspects that agentB might have received the message unchanged, that is exactly as it was sent: he receivedminA’s name, which is the following action

qB,r,m,A

2. He suspects that the intruderCmight have changed the content of his message to another propo- sition m0. In this case the intruder’s actions are: he received A’s message and sent another message toB with a fake contentm0 but keptA’s name on it, soB received a message inA’s name but with a different content, which is the following sequential composition

qC,r,m,A•qC,s,m0,B•qB,r,m0,A

3. He suspects that the intruderC might have changed the sender’s name fromAto his own name

then sending it toB. These actions ofCform the following sequential composition

qC,r,m,A•qC,s,m,B •qB,r,m,C

4. He suspects that the intruderCmight have changed both the original content, for examplemto

m0, and the claimed sender fromAtoC. His actions are

qC,r,m,A•qC,s,m0,B•qB,r,m0,C

5. The last option might be thatCstopped the message and took no further actions, thusBreceived nothing. In this case,C’s actions are

qC,r,m,A•1

AgentAhas all these suspicions and is not sure which one has really happened in reality. So we use the non-deterministic choice of the quantale to put all these cases together and form the suspicions of agentAabout the receive action:

fA(qB,r,m,A) = qB,r,m,A

∨ (qC,r,m,A•qC,s,m0,B•qB,r,m0,A) ∨ (qC,r,m,A•qC,s,m,B •qB,r,m,C) ∨ (qC,r,m,A•qC,s,m0,B•qB,r,m0,C) ∨ (qC,r,m,A•1)

This says that A suspects either of these disjuncts could have happened. Although very suspicious about the receive of his message, agentAhas no suspicions about the action originated from his own side, that is the send action. This is denoted by making the suspicion operator act as identity:

fA(qA,s,m,B) =qA,s,m,B

Now assume that after agentAsent his message, agentBreceived the message exactly as it was, but of course he does not know that he has received the message unchanged. So what doesBsuspect about the message he has received? We assume thatB’s suspicions about the send action are the following four cases

1. Bsuspects that the message might have been sent exactly as he received it, that is containingm

and sent byA, that is

qA,s,m,B

mon the way. These form the following sequential composition

qA,s,m0,B•qC,r,m0,A•qC,s,m,B

3. Or it might have been the case thatA intended the message to C, but C is redirecting it toB

without changing anything. These form the following sequential composition

qA,s,m,C •qC,r,m,A•qC,s,m,B

4. It might have been the case thatAsent another message containingm0toCandCchanged both the content tomand the intended receiver’s name and redirected it toB inA’s name, that is

qA,s,m0,C•qC,r,m0,A•qC,s,m0,B

Note that B can also suspect that A was not the original sender, but we ignore this option for the time. Because if we want to consider it, we either have to add another agent other thanCas the real sender, and this will double the length of all suspicions, or assumeA can also be an intruder, which is contradictory with our other assumption thatC was the only intruder. Ignoring these suspicions, however, will not change our results about authentication1.

We use the non-deterministic choice to put all these cases together and form the suspicions ofB

about the send action:

fB(qA,s,m,B) = qA,s,m,B

∨ (qA,s,m0,B•qC,r,m0,A•qC,s,m,B) ∨ (qA,s,m,C•qC,r,m,A•qC,s,m,B) ∨ (qA,s,m0,C•qC,r,m0,A•qC,s,m,B)

Similar to the previous case,Bis sure about his own actions, that is the receive of the message:

fB(qB,r,m,A) =qB,r,m,A

We have now associated suspicions about each action to each honest agent involved in the protocol. These form the base of our setting. In the next section we show how suspicions of agents about proto- cols (sequences of send and receive actions) can be compositionally calculated from these suspicions.

1

If we parametrize the agents and contents, then this option then we would have a better way to encode suspicions and can add these suspicions as well.