In order to reason about properties of secure action systems, we present in this section their formal semantics in ITL. Let SAS = (Pb ,A, Agents, Actions, P olicy) be a se- cure action system. Firstly, the set of variables is extended with a collection of (control) Boolean variablesreadyp, for each agentp∈ P, indicating whether the agent is ready or
currently involved in the execution of some action. LetV ar0 =b V ar∪ {ready
p |p∈ P}
be the new set of variables. The semantics of a statementS (described by the grammar given in Definition 3.7) relatively to a setV of variable symbols is an ITL formulaCV[[S]]
defined inductively on the structure of statements as follows:
CV[[x:=exp]] =b skip ∧ ((x) =exp) ∧ ∧
u∈(V\x)stable(u).
CV[[skip]] =b CV[[V :=V]].
CV[[S1;S2]]=b CV[[S1]];CV[[S2]].
CV[[if bthen S1else S2]] = (bb ∧ CV[[S1]]) ∨ (¬b ∧ CV[[S2]]).
CV[[for K := 1to ndo S]] =b CV[[K := 1]]; (CV[[S;K :=K+ 1]])n.
Note that the semantics CV[[S]] of a statement S relatively to a set of variables V
controls only the behaviours of the variables in the setV. Therefore, any variable not in
V can change independently during the execution of the statementS. For example, the semantics of an assignment x := exp relatively to a set of variable V is the set of all
intervals (behaviours)σ =b σ0σ1 of length one for which the value ofx in the next state
is equal to the value of the expressionexp in the initial state, and the other variables in
V remain unchanged. Figure 3.3 illustrates the semantics of x := 2relatively to the set
{x, y, z}which is a subset of the system state{x, y, z, u}. The value ofxis equal to2in the next state andy andz are kept unchanged. However, the variableu is controlled by the environment and therefore can take any value in the next state.
σ0 σ1 • • x: 0 x: 2 y: 0 y: 0 z : 0 z : 0 u: 0 u: 5
Figure 3.3: Illustration ofC{x,y,z}[[x:= 2]]
Remember that the body of an actiona∈ Adefined as in Equation 3.4 (see page 49), cannot contain statements that change the state of an agent in the setWa. Only variables
in the states of the synchronisation agents of the action can be modified by the execution of the action. Let Va =b ∪
p∈Ra∪Ua
V ar0(p) be the set of variables that are allowed to be
modified by the execution of the actiona. We are now ready to give the semantics of an action in ITL.
An actionais enabled if both its functional guardga and its security guardha holds
and all its synchronisation agents are ready. This is formulated in ITL by the formula
enableda =b ga ∧ ha ∧ ∧ p∈Ra∪Ua
The semantics of an actionais given by the formula
ψa =b enableda ∧ CVa[[ready
a :=f alsea;S
a;readya:=truea]],
wherereadyais the list of all the variableready
p, p ∈ Pa andf alsea (resp. truea) is a
list of constantsf alse(resp. true) that matches the listreadya. Note that the variables in
Va which are not modified in the bodySa of the actiona are kept unchanged during the
execution of the action.
The behaviour of an agentp ∈ P is defined in terms of the semantics of the actions the agentpparticipates in. At any instant, an agentp∈ P is involved in the execution of exactly one action inApwhich is enabled orpis idle (doing nothing) if none of the actions
inAp is enabled. When the agent is idle its state is kept unchanged. This is formulated in
ITL by the formula
ϕp = ((b ] a∈Ap
ψa) ∨ (( ∧ a∈Ap
¬enableda) ∧ idlep))∗,
where]denotes the operator exclusive-or and
idlep =b empty ∨ (skip ∧ stable(V ar(p))).
The initial state of the system is described by the state formula
(3.5) initial = (b ∧
p∈Preadyp) ∧ (p∈P∧0(yp =cp)),
whereP0 is the set of agentsp ∈ P such thatInit(p)=b y
p := cp. Initially all the agents
The execution of the system terminates if all agents are ready and no guard is true. This is expressed by the state formula
f inal = (b ∧
p∈Preadyp) ∧ (a∧∈A¬(ga∧ha)).
Remember that if two or more actions sharing a common synchronisation agent are enabled at the same time, only one of them is chosen (nondeterministically) for execution. In order to ensure that computations are fair, we use the notion of action fairness which states that if an action is enabled infinitely often then the action is also executed infinitely often. The action fairness requirement is specified by the following formula, whereinf
specifies an infinite interval:
actionF air =b inf ⊃2( ∧ a∈A((
23(ga∧ha))⊃3ψa)).
It is also important that computations are agent fair. The notion of agent fairness requires that no agent may be indefinitely held up while some of the joint actions it par- ticipates in are infinitely often enabled. This requirement is formalised as
agentF air =b inf ⊃2( ∧ p∈P(( 23 ∨ a∈Ap enableda)⊃3 ∨ a∈Ap ψa)).
The semantics of the concurrent execution of a secure action systemSAS is defined by the formula
C[[SAS]] =b (initial ∧ halt(f inal) ∧ ( ∧
p∈Pϕp) ∧ actionF air ∧ agentF air).
The formulaC[[SAS]]states that the execution of an action system starts with an initialisa- tion step (or skip if no initialisation statements is specified), and repeatedly all the enabled
actions are executed in parallel. However, at any time an agent is participating in the exe- cution of at most one action. The execution terminates if a state is reached where all the agents are ready and all the action guards are false (this is specified ashalt(f inal)). If the computation is infinite then both the action fairness and the agent fairness requirements are enforced.