A Cloud Brokerage Solution: Formal Methods Meet Security in Cloud Federations

Souaf, Salwa; Berthomé, Pascal; Loulergue, Frédéric

doi:10.1109/hpcs.2018.00113

Cited by 5 publications

(5 citation statements)

References 25 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…One of the motivations for this tool is our project around a broker for the Cloud that takes into account user security requirements that can be expressed as first order relational logic formulas and that we checked using Alloy/Kodkod [25]. In order to increase the trust in this broker, we aim at formalizing all the hypothesis made on the system, and make sure that if the formal requirement given by the user contains no error and are added to the system, then conclusions about the security of the new state of the system can be drawn.…”

Section: Discussionmentioning

confidence: 99%

A First Step in the Translation of Alloy to Coq

Souaf

Loulergue

2019

Formal Methods and Software Engineering

Self Cite

View full text Add to dashboard Cite

Alloy is both a formal language and a tool for software modeling. The language is basically first order relational logic. The analyzer is based on instance finding: it tries to refute assertions and if it succeeds it reports a counterexample. It works by translating Alloy models and instance finding into SAT problems. If no instance is found it does not mean the assertion is satisfied. Alloy relies on the small scope hypothesis: examining all small cases is likely to produce interesting counterexamples. This is very valuable when developing a system. However, Alloy cannot show their absence. In this paper, we propose an approach where Alloy can be used as a first step, and then using a tool we develop, Alloy models can be translated to Coq code to be proved correct interactively.

show abstract

Section: Discussionmentioning

confidence: 99%

A First Step in the Translation of Alloy to Coq

Souaf

Loulergue

2019

Formal Methods and Software Engineering

Self Cite

View full text Add to dashboard Cite

show abstract

“…Similarly the authors of [176] have proposed a security framework for cloud complexity management (agent) system [116], utilizing the Z/EVES theorem prover to analyse several cloud security properties within a NIST [45] cloud reference architecture. Also in the work [236] the authors have proposed a broker solution for automatically pairing cloud services with customers, while managing the cloud complexity. An important part of the broker is finding a service satisfying customers security requirements, defined in first order relational logic [133] using KODKOD finite model finder [248].…”

Section: Enterprisementioning

confidence: 99%

A Survey of Practical Formal Methods for Security

et al. 2022

View full text Add to dashboard Cite

In today’s world, critical infrastructure is often controlled by computing systems. This introduces new risks for cyber attacks, which can compromise the security and disrupt the functionality of these systems. It is therefore necessary to build such systems with strong guarantees of resiliency against cyber attacks. One way to achieve this level of assurance is using formal verification, which provides proofs of system compliance with desired cyber security properties. The use of Formal Methods (FM) in aspects of cyber security and safety-critical systems are reviewed in this article. We split FM into the three main classes: theorem proving, model checking and lightweight FM. To allow the different uses of FM to be compared, we define a common set of terms. We further develop categories based on the type of computing system FM are applied in. Solutions in each class and category are presented, discussed, compared and summarised. We describe historical highlights and developments and present a state-of-the-art review in the area of FM in cyber security. This review is presented from the point of view of FM practitioners and researchers, commenting on the trends in each of the classes and categories. This is achieved by considering all types of FM, several types of security and safety-critical systems and by structuring the taxonomy accordingly. The article hence provides a comprehensive overview of FM and techniques available to system designers of security-critical systems, simplifying the process of choosing the right tool for the task. The article concludes by summarising the discussion of the review, focusing on best practices, challenges, general future trends and directions of research within this field.

show abstract

“…The work in [ 23 ] addresses existing cybersecurity issues in cloud environments by applying formal verification. The proposed solution defines security properties by addressing cyberattacks in online environments.…”

Section: Related Workmentioning

confidence: 99%

“… [ 32 ] X X X Real-world cloud system concept that can be used in analysis and implemented. [ 23 ] X X Additional cloud-related security issues in form of a greater challenge. [ 24 ] X System models to generate and execute model-based tests.…”

Section: Related Workmentioning

confidence: 99%

Robust Financial Fraud Alerting System Based in the Cloud Environment

Stojanović

Božić

2022

Sensors

View full text Add to dashboard Cite

The digitalisation of finance influenced the emergence of new technological concepts for existing user needs. Financial technology, or fintech, provides improved services for customers and new economic value for businesses. As such, fintech services require on-demand availability on a 24/7 basis. For this reason, they are often deployed in cloud environments that allow connectivity with ubiquitous devices. This allows customers to perform online transactions, which are overseen by the respective financial institutions. However, such cloud-based systems introduce new challenges for information security. On one hand, they represent attractive targets for cyberattacks. On the other, financial frauds can still go unnoticed by the financial institutions in charge. This paper contributes to both challenges by introducing the concept for a cloud-based system architecture for fraud detection and client profiling in the banking domain. Therefore, a systematic risk assessment was conducted in this context, and exploitation probabilities were inferred for multiple attack scenarios. In addition, formal verification was accomplished in order to determine the effects of successful vulnerability exploits. The consequences of such security violations are discussed, and considerations are given for improving the resilience of fintech systems.

show abstract

A Cloud Brokerage Solution: Formal Methods Meet Security in Cloud Federations

Cited by 5 publications

References 25 publications

A First Step in the Translation of Alloy to Coq

A First Step in the Translation of Alloy to Coq

A Survey of Practical Formal Methods for Security

Robust Financial Fraud Alerting System Based in the Cloud Environment

Contact Info

Product

Resources

About