英文翻译.docx

1、英文翻译Model Checking for E-Business Control and AssuranceBonnie Brinton Anderson, James V. Hansen, Paul Benjamin Lowry,and Scott L. SummersAbstractModel checking is a promising technique for the verication of complex software systems. As the use of the Internet for conducting e-business extends the re

2、ach of many organizations, well-designed software becomes the foundation of reliable implementation of e-business processes.These distributed, electronic methods of conducting transactions place reliance on the control structures embedded in the transaction processes.Deciencies in control structures

3、 of processes that support e-business can lead to loss of physical assets, digital assets, money, and consumer condence. Yet, assessing the reliability of e-business processes is complex andtime-consuming.This paper explicates how model-checking technology can aid in the design and assurance of e-bu

4、siness processes in complex digital environments. Specically, we demonstrate how model checking can be used to verify e-business requirements concerning money atomicity, goods atomicity, valid receipt, and communication-link failure. These requirements are fundamental to many e-business applications

5、.Model checking can be used to test a broad range of systems requirementsnot only for system designers, but also for auditors and security specialists. Systems that are examined by auditors need to have adequate controls built in prior to implementation and will need adequate auditing after implemen

6、tation to ensure that none of the processes have been corrupted. Model checkers may also provide value in examining the processes of highly integrated applications as found in enterprise resource planning systems.Index Terms：Atomicity, data typing, e-Business, model checking,process and communicatio

7、n protocols.I. INTRODUCTIONInternet-based business operations offer considerable potential, but they are accompanied by a broad range of often unprecedented risks.An actual or perceived lack of system security and reliability can signicantly constrain the growth of the digital economy. While progres

8、s is being made in reducing Internet computational risks through a variety of software patches and cryptographic algorithms, these efforts address only a small portion of the larger challenge of establishing thenecessary security and reliability of e-business systems. To resolve this challenge, syst

9、ematic management of the associated operational risks is essential 1.According to Wang et al. 2, management of operational risks requires careful examination of the e-business infrastructure. Distributed Internet computing is changing e-market structures and e-business models in fundamental ways. Al

10、though the exibility of distributed e-operations supports open accessibility and dynamic interactions,exibility can intensify problems arising from e-market information asymmetry and e-business operational uncertainty. These problems militate against innovative e-commerce developments. Although e-co

11、mmerce offers the opportunity for businesses to gain efciency and effectiveness through network-based ad-hoc partnerships, many businesses do not take advantage of these opportunities because of the heightened risks of operational uncertainty and perceived information asymmetry among unfamiliar busi

12、ness partners.Manuscript received November 18, 2003; revised May 17, 2004. This paper was recommended by Associate Editor S. Lakshmivarahan.The authors are with the Marriott School of Management andKevin and Debra Rollins Center for e-Business, Brigham YoungUniversity, Provo, UT 84602 USA (e-mail: B

13、onnie_AndersonBYU.edu;James_HansenBYU.edu, Paul_LowryBYU.edu; Scott_SummersBYU.edu).Digital Object Identier 10.1109/TSMCC.2004.843181 These issues take on added importance as new business models and architecturessuch as Internet auctions, web services 3 and the semantic web 4offer broad support for

14、loosely coupled, e-commerce transactions where buyers and sellers may not have any prior trading experience with one another. For example, the web services 3 platform provides the Universal Description, Discovery and Integration (UDDI) registry for discovery of e-commerce services, WSDL for service

15、description, and SOAP for transaction execution. These facilities require no prior knowledge of buyer and seller by either party.In such environments, merchants and customers may be reluctant to trust one another and the following situations may arise: A customer is unwilling to pay for a product wi

16、thout being certain the correct product will be sent. A merchant is unwilling to send a product without certainty of receiving payment. If a merchant delivers the product without receiving payment, a fraudulent customer may receive the product and then disappear, with a resulting loss to the merchan

17、t. If a customer pays before receiving the product, a merchant may not deliver or may deliver a wrong product. These possibilities underscore the need for carefully designed e-commerce models that are robust under all events.As Wang et al. 5 note, e-system complexity and human limitations make it im

18、possible to imagine all scenarios and guarantee correct processing under all circumstanceseven for carefully designed and implemented code. Much of this difculty is due to interconnectivity, which widens the potential range of error or vulnerability. Variation in execution of concurrent processes in

19、 nonstop, nondeterministic systems increases the potential for automation failures. Consequently mini mizing aws in transaction protocols is crucial for the survival and sustainability of e-business. Stakeholders, such as system designers,users, and auditors need methods to preclude these subtle but

20、 potentially critical mistakesbefore erroneous processing occurs or an attacker exploits themto enhance control and assurance to e-commerce users. Model checking offers a promising method for addressing these issues.II. MODEL CHECKING FUNDAMENTALSAutomation failures occur when an automated system be

21、haves differently than its stakeholders expect. If the actual system behavior and the stakeholders model are both described as nite state transition systems, then mechanized techniques known as model checking can be used to automatically discover any scenarios that cause the behaviors of the two des

22、criptions to diverge from one another. These scenarios identify potential failures and pinpoint areas where design changes or revisions should be consideredModel checking can trace through all relevant states with respect to any given requirement. Since model checking operates on logic rather than i

23、ndividual execution paths, verication can be more thorough and efcient than test runs and simulation. Some of the most compelling features of model checkers are summarized as follows 6.1) They help delimit a systems boundary or the interface between the system and its environment.2) They precisely d

24、ene a systems desired properties.3) They characterize a systems behavior more accurately. Most current methods focus on functional behavior only (e.g., “What is the correct answer?”) but some can handle real-time behavior as well (e.g., “Is the correct answer delivered on time?”).4) They can aid in

25、proving that a system meets required specications. By providing counterexamples that show how specications are not satised, model checkers can pinpoint the circumstances under which a system does not meet its specications.This can also help to correct the system.These features of model checkers aid

26、stakeholders in two important ways.1) Through specication, by focusing a system designers attention to crucial questions, such as: What is the interface? What are the assumptions about the applications environment? What is the system supposed to do under this condition or that condition?What happens

27、 if that condition is not met? What are the systems invariant properties?2) Through verication, by providing additional assurance. Relying on proof that a system meets its security goals is better than relying on opinioneven expert opinion.It should be emphasized that any proof of correctness is rel

28、ative to both the formal specication of a system and the formal specication of the desired properties: a system proven correct with respect to an incorrect specication leaves no assurance about the system at all.The process of proving entails three actions: First, the system of interest must be mode

29、led. A mathematical model is constructed that expresses the semantic structure of an e-business implementation.Second, all properties to be guaranteed in the implementation are formally specied. In an e-business context, one such specication might be that goods must always be received before payment

30、 is initiated.Third, a proof is provided. Typically, a proof relies on induction over traces of the e-commerce communication and transaction operations.In general, verifying that any e-business process is resilient to hidden aws and errors is a daunting task. Manual methods are slow and error prone.

31、 Even theorem provers, which provide a formal structure for verifying standard characteristics, may require human intervention and can be time-consuming. Moreover, even if a failure is found using a theorem prover, it may provide little help in locating the source of thefailure 2. Simulations offer

32、computational power, but they are ad hoc in nature and there is no guarantee they will explore all important contingencies 2.In contrast, model checking is an evolving technology that can provide effective and efcient evaluation of e-business processes. Model checking was originally developed for validating highly complex integrated circuits and software packages 7, 8, but it has recently been adopted to tackle the complexity of e-commerce transactions 9,2, 10. Current model-checking technology is based on automated techniques that a