CoCon: A conference management system with formally verified document confidentiality
Popescu, Andrei, Lammich, Peter and Hou, Ping (2021) CoCon: A conference management system with formally verified document confidentiality. Journal of Automated Reasoning, 65 (2) . pp. 321-356. ISSN 0168-7433 [Article] (doi:10.1007/s10817-020-09566-9)
![[img]](https://eprints.mdx.ac.uk/style/images/fileicons/application_pdf.png) |
PDF
- Published version (with publisher's formatting)
Available under License Creative Commons Attribution 4.0. Download (1MB) |
Abstract
We present a case study in formally verified security for realistic systems: the information flow security verification of the functional kernel of a web application, the CoCon conference management system. We use the Isabelle theorem prover to specify and verify fine-grained confidentiality properties, as well as complementary safety and “traceback” properties. The challenges posed by this development in terms of expressiveness have led to bounded-deducibility security, a novel security model and verification method generally applicable to systems describable as input/output automata.
| Item Type: | Article |
|---|---|
| Keywords (uncontrolled): | Article, Information-Flow Security, Confidentiality, Unwinding Proof Method, Theorem Proving, Isabelle/HOL, Conference Management System |
| Research Areas: | A. > School of Science and Technology > Computer Science |
| Item ID: | 32168 |
| Notes on copyright: | © The Author(s) 2020
Open Access: This article is licensed under a Creative Commons Attribution 4.0 International License, which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons licence, and indicate if changes were made. The images or other third party material in this article are included in the article’s Creative Commons licence, unless indicated otherwise in a credit line to the material. If material is not included in the article’s Creative Commons licence and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder. To view a copy of this licence, visit http://creativecommons.org/licenses/by/4.0/. |
| Useful Links: | |
| Depositing User: | Jisc Publications Router |
| Date Deposited: | 04 Mar 2021 08:16 |
| Last Modified: | 13 May 2022 16:03 |
| URI: | https://eprints.mdx.ac.uk/id/eprint/32168 |
Actions (login required)
 |
View Item |
Statistics
Additional statistics are available via IRStats2.
CORE (COnnecting REpositories)
CORE (COnnecting REpositories)