A formal validation of the RBAC ANSI 2012 standard using B

Nghi Huynh (1, 2) , Marc Frappier (1) , Amel Mammar (3, 4, 5, 6) , Régine Laleau (2) , Jules Desharnais (7)

1 UdeS - Département d'informatique [Sherbrooke]
2 LACL - Laboratoire d'Algorithmique Complexité et Logique
3 METHODES-SAMOVAR - Méthodes et modèles pour les réseaux
4 TSP - INF - Département Informatique
5 SAMOVAR - Services répartis, Architectures, MOdélisation, Validation, Administration des Réseaux
6 CNRS - Centre National de la Recherche Scientifique
7 ULaval - Université Laval [Québec]

We validate the RBAC ANSI 2012 standard using the B method. Numerous problems are identified: logical errors, inconsistencies, ambiguities, typing errors, missing preconditions, invariant violation, inappropriate specification notation. A clean version of the standard written in the B notation is proposed. We argue that the ad hocmathematical notation used in the standard is inappropriate and we propose that a more methodological and tool-supported approach must definitely be used for writing standards, in order to avoid the issues identified in the paper. Human reviewing is insufficient to produce error-free international standards

Mots clés: B method; Invariant preservation; Role-Based Access Control

Domaines: Calcul formel [cs.SC]; Génie logiciel [cs.SE]

Nghi Huynh, Marc Frappier, Amel Mammar, Régine Laleau, Jules Desharnais. A formal validation of the RBAC ANSI 2012 standard using B. Science of Computer Programming, 2016, 131, pp.76 - 93. ⟨10.1016/j.scico.2016.04.011⟩. ⟨hal-01390991⟩