Model checking for e-Business control and assurance

Abstract

Model checking is a promising technique for the verification of complex software systems. As the use of the Internet for conducting e-business extends the reach of many organizations, well-designed software becomes the foundation of reliable implementation of e-business processes. These distributed, electronic methods of conducting transactions place reliance on the control structures embedded in the transaction processes. Deficiencies in control structures of processes that support e-business can lead to loss of physical assets, digital assets, money, and consumer confidence. Yet, assessing the reliability of e-business processes is complex and time-consuming. This paper explicates how mode l-checking technology can aid in the design and assurance of e-business processes in complex digital environments. Specifically, we demonstrate how model checking can be used to verify e-business requirements concerning money atomicity, goods atomicity, valid receipt, and communication-link failure. These requirements are fundamental to many e-business applications. Model che cking can be used to test a broad range of systems requirements - not only for system designers, but also for auditors and security specialists. Systems that are examined by auditors need to have adequate controls built in prior to implementation and will need adequate auditing after implementation to ensure that none of the processes have been corrupted. Model checkers may also provide value in examining the processes of highly integrated applications as found in enterprise resource planning systems. © 2005 IEEE.