Jeremy Bryans

1
Formalising Dynamic CoalitionsBudi Arief,
Jeremy Bryans, John Fitzgerald, Carl Gamble,
Michael Harrison, Nigel Jefferson, Cliff Jones,
Igor Mosolevsky, Peter Ryan
2
Introduction

• An example Dynamic Coalition
• Our aim
• Formalising
• Conclusions

3
Formal Specification of Dynamic Coalitions (at
NCL)Dynamic Coalitions Virtual Organisations

• Looking for a formal answer to the question
• What is a Dynamic Coalition?
• History
• whiteboarding (CBJ, JWB)
• Ramsay Taylor dstl July October 2004
• Currently (the Dynamic Coalitions coalition)
• (weekly meetings)
• Budi Arief, Jeremy Bryans, John Fitzgerald, Carl
  Gamble, Michael Harrison, Nigel Jefferson, Cliff
  Jones, Igor Mosolevsky, Peter Ryan

4
History

• GOLD- EPSRC project to develop tool support to
  facilitate the running of Virtual Enterprises
  within the Chemical Engineering industry.
• Some DIRC funding from dstl, who are interested
  in Dynamic Coalitions

5
GOLD Virtual Enterprises

• Actors chemical companies (providing web
  services)
• Structure subcontractors brought in as necessary
  
• Knowledge H2SO4,
• Communications lab books, excel files of
  experimental results, safety reports,

6
dstl Dynamic Coalitions

• Actors governments, spies, fighter jets,
• Structure complex political alliances, battle
  allies,
• Knowledge political info, battle info
• Communications radar, radios, telephone, CNN,

7
A Healthcare Dynamic Coalition

• Actors patients with wearable thermometers
  blood sugar monitors, hospitals with various
  machines, doctors, paramedics,
• Structure Collection of experts with different
  roles (not necessarily a fixed hierarchy.)
• Information patient history, medical decisions,
• Communications
• permanent links (e.g. between machines in
  intensive care)
• transient links (e.g. wearable monitors)

8
A Dynamic Coalition is

• A set of actors, possibly structured
• Ways of communication
• broadcast, mailing lists, one-to-one,
• Some common knowledge
• e.g. definitions of common terms, joining/leaving
  rules,
• Possible actions
• Joining, leaving, creating a DC, (destroying a
  DC?)

9
Our intention

• ...to model a theory of knowledge distribution,
  in which dynamic coalitions form, change and
  disperse. position paper
• This means we need to have a (formal) model of
• what a VO is
• what knowledge is
• how it is communicated.
• (In fact, an increasingly refined family of
  formal models.)
• And (at least) an animator for these models.

10
Our Research

• Observing and analysing information flows in
  Dynamic Coalitions.
• Detecting and removing insecure information
  flows.
• Build a formal model
• (In fact, an increasingly refined set of formal
  models.)
• An animation of this model.

11
Security objectives

• To use this model to analyse information flows in
  Dynamic Coalitions.
• Two assumptions
• Some information is an asset
• in the sense that it must be protected
• Some information must be shared
• an obligation of DC membership

12
Analysing information flows.

• We wish to be able to model (at least) the
  following properties
• Parties may know different things.
• Information has value. (as an asset)
• The value of information may change over time.
• Different parties may make different inferences
  from the same pieces of information.
• Or the same inference from different pieces of
  information.

13
Other (security-relevant) issues

• Information about information e.g.
• provenance
• who else knows it?
• do I believe it? (agent view)
• is it true? (state view)
• Rules/policies for communicating within DCs

14
Where we are

• working on a number of formal (VDM) models
• v 1 adds and removes agents from VOs.
• v 1 time global-info-worth
• v 1 time local-info-worth
• v 1 (Igor) includes (in a meta-info component)
• value, provenance, who else knows it?, do I
  believe it?, who owns it?, as well as functions
  for communicating information,

15

• An example Dynamic Coalition
• Our aim
• Formalising
• Conclusions

16
the state model
C1
C2
A1
A3
A3
A2
17
the agent model
A Cid maps to all knowledge associated with
that coalition. null maps to everything that
the agent knows. E.g.
null
k1,k2,k3 k4,k5,k6
C1
C2
k5
k1
k3
k3
k2
k4
18
A modelling example

• Question How to model provenance of information?

19
solution 1 (BSCW)
Every bit of information is (globally) associated
with a single originator.
20
solution 2 (who told me what)
Every agent associates each KId they know with a
single originator.
21
solution 3
Every agent associates each KId they know with a
sequence of agents. (full audit trail)
22
Further complications

• People could lie about where information arises,
• or refuse to tell
• Some senior government source
• You may have two sources for the same information
• but you may not trust one of them

23
Conclusions

• Can quickly describe what we mean.
• Can see how new features interact with earlier
  ones.

24
Thank you
25
Possible view of an animator
Possible scenarios in (from a model-checker?)
model
d
e
Scenario 1
Join (a,b)
c
a
b
Unjoin(b,e)
Share_info (x,b,d)
Possible questions
Who knows information x ?
Does anyone have sufficient information to
calculate y ?
26
Conclusions

• Using Formal Methods forces us to (quickly)
  decide exactly what we want to mean by
  provenance, coalitions, virtual
  organisations, etc.

27
Possible animator
actor
communication
knowledge
28
Tracing information
actor
communication
knowledge
29
Open questions
30
Two ways to learn something

• Get told, or
• work it out inferences rules
• Inferences rules belong to agents.

X,Y,Z
P
31
Information flow model
high user
system
BOUNDARY
low user (adversary)
System common computer?
What information can flow across the boundary?
Given Lows knowledge of SYSTEM, He may be able
to infer information about high activity.
32
Complicating the model

• Refining knowledge
• From tokens to triples
• (binding, token1, token2)
• e.g. (on, cat, mat)
• Linking knowledge to real world
• (real-world, (on, cat, mat), false)
• This is a big can of worms
• e.g. I know you believe X, where X is not true.

33
A Dynamic Coalition is

• A set of actors
• Ways of communication
• broadcast, mailing lists, one-to-one,
• Some common knowledge
• e.g. definitions, joining/leaving rules,
• possible actions
• Joining, leaving, creating a DC, (destroying a
  DC?)