Model checking for E-business control and assurance

Model checking is a promising technique for the verification of complex software systems. As the use of the Internet for conducting e-business extends the reach of many organizations, well-designed software becomes the foundation of reliable implementation of e-business processes. These distributed, electronic methods of conducting transactions place reliance on the control structures embedded in the transaction processes. Deficiencies in control structures of processes that support e-business can lead to loss of physical assets, digital assets, money, and consumer confidence. Yet, assessing the reliability of e-business processes is complex and time-consuming. This paper explicates how model-checking technology can aid in the design and assurance of e-business processes in complex digital environments. Specifically, we demonstrate how model checking can be used to verify e-business requirements concerning money atomicity, goods atomicity, valid receipt, and communication-link failure. These requirements are fundamental to many e-business applications. Model checking can be used to test a broad range of systems requirements-not only for system designers, but also for auditors and security specialists. Systems that are examined by auditors need to have adequate controls built in prior to implementation and will need adequate auditing after implementation to ensure that none of the processes have been corrupted. Model checkers may also provide value in examining the processes of highly integrated applications as found in enterprise resource planning systems.

I. Introduction

Internet-based business operations offer considerable potential, but they are accompanied by a broad range of often unprecedented risks. An actual or perceived lack of system security and reliability can significantly constrain the growth of the digital economy. While progress is being made in reducing Internet computational risks through a variety of software patches and cryptographic algorithms, these efforts address only a small portion of the larger challenge of establishing the necessary security and reliability of e-business systems. To resolve this challenge, systematic management of the associated operational risks is essential [1].