A framework for the development of a family of trustworthy systems

点击翻译按钮获取中文摘要

Software plays a predominant role in our society, often not just guiding us but forcing us to respond to specific actions, bringing thus both rewards and risks. Software for smart medical devices and on-line health care systems are prime examples. They bring enormous benefits, but when they malfunction or fail the patients are in peril. Safety, security, and privacy are the attributes that determine trust in such applications. In the sector of on-line finance and E-commerce, software can be trusted only if it is secure, provides timely service, enforces obligations, and affords privacy. In transportation domain, aircrafts have autopilots installed in them, which once initialized will take away the control of a pilot, resulting in cruising pleasure and occasionally resulting in a severe accident. Safety, security, reliability, and availability are all essential attributes to ensure trust in such software. In the energy sector, large power grids and nuclear power plants should be safe-guarded and protected without fail. Without a direct evidence of safety and security software that monitors and manages these systems cannot be trusted. These examples illustrate the types and severity of risks that vary from one sector to another sector. The risk in interacting with software must be made explicit in order that clients may decide how well they want to trust the system before using it. In particular, for software in privacy and safety-critical domains the dependability argument must be in the form of direct evidence that can be audited by a third party who need not be an expert. This argument should be an expression that includes the global context information, the critical properties of the software, and assumptions on its embedding, its environmental constraints, and direct evidence that the specified properties are satisfied. The goal of this research is the investigation of theory, methods, and a framework for a rigorous development of a family of trustworthy systems. The development framework should be general enough to enable the development of a trustworthy system in any domain for which a contract is specified. Formally constructing a chain of direct evidence and validating it at all stages of system development is an essential activity.