Jingde Cheng Department of Information and Computer Sciences, Saitama University, Japan Abstract. 2.

Transcription

1 Normativeness, Relevance, and Temporality in Specifying and Reasoning about Information Security and Assurance: Can We have a Formal Logic System as a Unified Logical Basis? (Position Paper) Jingde Cheng Department of Information and Computer Sciences, Saitama University, Japan cheng@ics.saitama-u.ac.jp As long as a branch of science offers an abundance of problems, so long is it alive: a lack of problems foreshadows extinction or the cessation of independent development. - David Hilbert, The formulation of a problem is often more essential than its solution, which may be merely a matter of mathematical or experimental skill. To raise new questions, new possibilities, to regard old problems from a new angle, requires creative imagination and marks real advance in science. - Albert Einstein, Abstract This position paper points out the NRT problem in specifying and reasoning about information security and assurance: Although it is necessary to deal with normative, relevance, and temporal notions explicitly and soundly in specifying and reasoning about information security and assurance, until now there is no formal logic system can be used as a unified logical basis for the purpose. Therefore, how to establish a formal logic system as a unified logical basis, which takes all of normativeness, relevance, and temporality into account, to underlie specifying and reasoning about information security and assurance is a urgent research problem. 1. Introduction Information security and assurance problems are intrinsically concerning the following questions: Who is authorized (permitted, or has right) to access and modify what information by what way from what machine or site in what time or state, and who does not be authorized to do so. Therefore, information security and assurance engineering is intrinsically an engineering discipline to deal with normative requirements and their implementation and verification (validation) techniques for secure information systems. Since informal requirements and their verification and validation are completely inadequate to guaranteeing information security and information assurance, formal logic systems have been used in specifying and reasoning about information security and assurance. However, there is a problem, named the NRT problem by the present author, in specifying and reasoning about information security and assurance: Although it is necessary to deal with normative, relevance, and temporal notions explicitly and soundly in specifying and reasoning about information security and assurance, until now there is no formal logic system can be used as a unified logical basis for the purpose. Therefore, how to establish a formal logic system as a unified logical basis, which takes all of normativeness, relevance, and temporality into account, to underlie specifying and reasoning about information security and assurance is a urgent research problem. The rest of this position paper presents some informal explanations on the problem. 2. Normativeness Any approach to specifying and reasoning about information security and assurance cannot be considered to be adequate if it does not deal with normative notions explicitly and soundly. Deontic logic is a branch of philosophical logic to deal with normative notions such as obligation (ought), permission (permitted), and prohibition (may not) for underlying normative reasoning [3, 4, 10, 23, 30, 36, 37, 39, 41, 51, 52]. Informally, it can also be considered as a logic to reason about ideal versus actual states or behaviour. It seems to be an adequate tool to specify and verify information security and assurance requirements. There have been some works on application of deontic logic to specifying and reasoning about information security and assurance. Cuppens first applied deontic logic (and also epistemic logic and temporal logic) to reasoning about security [19]. Bieber and Cuppens applied deontic logic to expression of security policies, and semantics of secure dependencies [5, 6, 7]. Dignum

2 and Kuiper use deontic and temporal logic to specifying deadlines with dense time in electronic commerce [21]. However, classical deontic logic has the well-known problem of deontic paradoxes as well as the problem of implicational paradoxes. Any work on this direction can not be said to be sound if it does not pay attention to and give some solution to these paradoxes. 3. Relevance The notion of relevance is crucial to finding or predicting some thing in reasoning, discovery, and prediction because in order to know or recognize some thing previously unknown or unrecognized, we have to investigate what are relevant to our knowledge or assumptions. Reasoning is the process of drawing new conclusions from given premises, which are already known facts or previously assumed hypotheses. Therefore, reasoning is intrinsically ampliative, i.e., it has the function of enlarging or extending some things, or adding to what is already known or assumed. In general, a reasoning consists of a number of arguments (or inferences) in some order. An argument (or inference) is a set of declarative sentences consisting of one or more sentences as its premises, which contain the evidence, and one sentence as its conclusion. In an argument, a claim is being made that there is some sort of evidential relation between its premises and its conclusion: the conclusion is supposed to follow from the premises, or equivalently, the premises are supposed to entail the conclusion. Therefore, the correctness of an argument is a matter of the connection (or relevance) between its premises and its conclusion, and concerns the strength of the relation between them (Note that the correctness of an argument depends neither on whether the premises are really true or not, nor on whether the conclusion is really true or not). A logically valid reasoning is a reasoning such that its arguments are justified based on some logical validity criterion provided by a logic system in order to obtain correct conclusions (Note that here the term correct does not necessarily mean true. ). Today, there are so many different logic systems motivated by various philosophical considerations. As a result, a reasoning may be valid on one logical validity criterion but invalid on another. For example, the classical account of validity, which is one of fundamental principles and assumptions underlying classical mathematical logic and its various classical conservative extensions, is defined in terms of truth-preservation (in some certain sense of truth) as: an argument is valid if and only if it is impossible for all its premises to be true while its conclusion is false. Therefore, a classically valid reasoning must be truthpreserving. On the other hand, for any correct argument in scientific reasoning as well as our everyday reasoning, its premises must somehow be relevant to its conclusion, and vice versa. The relevant account of validity is defined in terms of relevance as: for an argument to be valid there must be some connection of meaning, i.e., some relevance, between its premises and its conclusion. Obviously, the relevance between the premises and conclusion of an argument is not accounted for by the classical logical validity criterion, and therefore, a classically valid reasoning is not necessarily relevant. Proving is the process of finding a justification for an explicitly specified statement from given premises, which are already known facts or previously assumed hypotheses. A proof is a description of a found justification. A logically valid proving is a proving such that it is justified based on some logical validity criterion provided by a logic system in order to obtain a correct proof. The most intrinsic difference between reasoning and proving is that the former is intrinsically prescriptive and predictive while the latter is intrinsically descriptive and non-predictive. The purpose of reasoning is to find some new conclusion previously unknown or unrecognized, while the purpose of proving is to find a justification for some specified statement previously given. Proving has an explicitly given target as its goal while reasoning does not. Unfortunately, until now, many studies in Computer Science and Artificial Intelligence disciplines still confuse proving with reasoning. Discovery is the process to find out or bring to light of that which was previously unknown. For any discovery, both the discovered thing and its truth must be unknown before the completion of the discovery process. Since reasoning is the only way to draw new conclusions from given premises, there is no discovery process that does not invoke reasoning. Prediction is the process to make some future event known in advance, especially on the basis of special knowledge. For any prediction, both the predicted event and its occurrence must be unknown and uncertain before the completion of prediction process. Since reasoning is the only way to draw new conclusions from given premises, there is no prediction process that does not invoke reasoning. Proving is useful in verification and validation of information security and assurance requirements and their implementation. Almost all current formal analysis techniques in information security and assurance engineering invoke somehow proving based on some formal systems. However, proving techniques can only applied to those cases where an explicit statement needed to be proved has been given previously. In practices of the real world, when we have designed, say some cryptographic protocols for a security and assurance issue, what we often want to know is the answer to this question: is there some flaws that we did not consider? Since there is no explicit statement given previously, the only way we have to adopt is reasoning. Classical mathematical logic was established in order to provide formal languages for describing the mathematical structures with which mathematicians work, and the methods of proof available to them. Both the

3 object and the method of investigation of classical mathematical logic are mathematical proof (Note that mathematical proving is different from mathematical reasoning). Given its mathematical method, it must be descriptive rather than prescriptive, and its description must be idealized. Classical mathematical logic may be suitable to searching and describing a formal proof of a previously specified theorem, but not necessarily suitable to forming a new concept and finding a new theorem because the aim, nature, and role of the classical mathematical logic is descriptive and non-predictive rather than prescriptive and predictive. Classical mathematical logic is based on the classical account of validity, and represents the notion of conditional, which is intrinsically intensional, by the truth-functional extensional notion of material implication. As a result, even if a reasoning based on classical mathematical logic is classically valid, neither the necessary relevance between its premises and conclusion nor the truth of its conclusion in the sense of conditional can be guaranteed necessarily. Classical mathematical logic is a formal logic system for describing mathematical proofs but not a logic system for reasoning. Note that all problems in classical mathematical logic concerning the classical account of validity and the notion of material implication are remained in any of its various classical conservative extensions where the classical account of validity is adopted as the logical validity criterion and the notion of conditional is represented directly or indirectly by the notion of material implication. Relevant (relevance) logic is a branch of philosophical logic to deal with the notion of entailment for underlying relevant reasoning [1, 2, 20, 22, 34, 40]. It was established during the 1950s in order to find a mathematically satisfactory way of grasping the elusive notion of relevance of antecedent to consequent in conditionals, and to obtain a notion of implication which is free from the so-called paradoxes of material and strict implication. Some major traditional relevant logic systems are system E of entailment, system R of relevant implication, and system T of ticket entailment. A major feature of these relevant logics is that they have a primitive intensional connective to represent the notion of conditional and their logical theorems include no implicational paradoxes. Strong relevant (relevance) logic proposed by the present author rejected all implicational paradoxes in classical mathematical logic as well as traditional relevant logic [11, 15]. Almost all current logic-based approaches to information security analysis are based on classical mathematical logic and its various classical and nonclassical conservative extensions, and therefore, they are verification-oriented [9, 38, 45, 46, 47]. As mentioned above, in order to deal with issues in practices of the real world, we need some reasoning-oriented approach to specifying and reasoning about information security and assurance. Relevant logic must play a crucial role in such reasoning-oriented approach. However, no research on applying relevant logic to specifying and reasoning about information security and assurance was reported until now. The only work concerning application of both relevant logic and deontic logic to specifying and reasoning about information security and assurance is the one proposed by the present author recently [17]. 4. Temporality Classical temporal logics was established in order to deal with those propositions whose truth-values may depend on time and therefore to underlie temporal reasoning [8, 24, 25, 50]. As a conservative extension of classical mathematical logic, they have remarkably expanded the uses of logic to reasoning about human (and hence computer) time-related activities [26]. In particular, they have been shown to be useful as the logic basis for specification and verification of traditional reactive systems [32, 33]. Since many information security and assurance issues are time-related, there have been some works on application of temporal logic to specifying and reasoning about information security and assurance. Syverson first proposed to add temporal formalisms to the logics of authentication [44]. Gray and McLean have applied temporal logic to specifying and verifying cryptographic protocols [29]. And, as mentioned in Section 2, Cuppens first applied deontic logic, epistemic logic, and temporal logic to reasoning about security [19], and Dignum and Kuiper use deontic and temporal logic to specifying deadlines with dense time in electronic commerce [21]. However, since any of classical temporal logics is a classical conservative extension of classical mathematical logic such that it is based on the classical account of validity and it represents the notion of conditional by the notion of material implication, all problems in classical mathematical logic concerning the classical account of validity and the notion of material implication are remained in all classical temporal logics. Therefore, even if a reasoning based on classical temporal logic is classically valid, neither the necessary relevance between its premises and conclusion nor the truth of its conclusion in the sense of conditional can be guaranteed necessarily. 5. The NRT Problem Based on the above discussions, we can say all of Normativeness, Relevance, and Temporality (NRT) are necessary to specifying, reasoning about, and verifying information security and assurance. It is well known that both deontic logic and temporal logic are modal logics in the sense that both deontic operators concerning normative notions and temporal operators concerning time notions are different interpretations of general modal operators in modal logics, and relevant logic E is also a modal logic.

4 Thus, this raises a fundamental question, the NRT problem named by the present author: How can we deal with those modal notions of normativeness, relevance, and temporality within one formal logic system as a unified logical basis to underlie specifying, reasoning about, and verifying information security and assurance? There have been some works on unifying two modal logics into one formal logic system. Stelzner first proposed relevant deontic logic [43]. Goble considered deontic logic with relevance [27]. Tagawa and the present author proposed deontic relevant logic based on strong relevant logic to remove those deontic paradoxes from classical deontic logic [48]. The present author proposed temporal relevant logic based on strong relevant logic in order to obtain one formal logic system to underlie both temporal and relevant reasoning [12, 13, 18]. However, there is no work on unifying all of deontic logic, relevant logic, and temporal logic into one formal logic system until now. At present, how to unify these modal logics is a completely open problem. Its solution needs a lot of investigations from the viewpoints of Philosophy, Logic, as well as Computer Science. 6. Concluding Remarks We have presented the NRT problem from the viewpoint of information security and assurance engineering and given some informal explanations on it. Logic is a special discipline which is considered to be the basis for all other sciences, and therefore, it is a science prior to all others, which contains the ideas and principles underlying all sciences [28, 31, 49]. Although we presented the NRT problem from the viewpoint of information security and assurance engineering, it is probably also interesting in both Philosoph and Logic. If the application domain and environment of an information system cannot be modelled as a simple YES- NO or WHITE-BLACK world (probably almost all application domains and environments in the real world are not bivalence worlds), then the notion of fuzziness and approximate reasoning have to be considered [14, 16]. Thus, in that case, the above NRT problem will become FNRT problem. References [1] A. R. Anderson and N. D. Belnap Jr., Entailment: The Logic of Relevance and Necessity, Vol. I, Princeton University Press, [2] A. R. Anderson, N. D. Belnap Jr., and J. M. Dunn, Entailment: The Logic of Relevance and Necessity, Vol. II, Princeton University Press, [3] L. Aqvist, Deontic Logic, in: D. Gabbay and F. Guenthner (Eds.), Handbook of Philosophical Logic, 2nd Edition, Vol. 8, pp , Kluwer Academic, [4] L. Aqvist, Introduction to Deontic Logic and the Theory of Normative Systems, Bibliopolis, [5] P. Bieber and F. Cuppens, Computer Security Policies and Deontic Logic, Proc. of the Workshop on Deontic Logic and Computer Science, pp , [6] P. Bieber and F. Cuppens, A Logical View of Secure Dependencies, Journal of Computer Security, Vol. 1, No. 1, [7] P. Bieber and F. Cuppens, Expression of Confidentiality Policies with Deontic Logic, in J.-J. C. Meyer and R. Wieringa (Eds.), Deontic Logic in Computer Science: Normative System Specification, pp , Wiley, [8] J. P. Burgess, Basic Tense Logic, in: D. Gabbay and F. Guenthner (Eds.), Handbook of Philosophical Logic, 2nd Edition, Vol. 7, pp. 1-42, Kluwer Academic, [9] M. Burrows, M. Abadi, and R. Needham, A Logic of Authentication, ACM Transactions on Computer Systems, Vol. 8, No. 1, pp , [10] J. Carmo and A. J. I. Jones, Deontic Logic and Contraryto-Duties, in: D. Gabbay and F. Guenthner (Eds.), Handbook of Philosophical Logic, 2nd Edition, Vol. 8, pp , Kluwer Academic, [11] J. Cheng, The Fundamental Role of Entailment in Knowledge Representation and Reasoning, Journal of Computing and Information, Vol. 2, No. 1, pp , [12] J. Cheng, Temporal Relevant Logic as the Logic Basis for Reasoning about Dynamics of Concurrent Systems, Proc IEEE-SMC Annual International Conference on Systems, Man, and Cybernetics, Vol. 1, pp , [13] J. Cheng, Temporal Relevant Logic: What Is It and Why Study It? Volume of Abstracts of the 11th IUHPS/DLMPS International Congress of Logic, Methodology and Philosophy of Science, p. 253, [14] J. Cheng, Fuzzy Relevant Logic: What Is It and Why Study It? Proc IEEE-SMC Annual International Conference on Systems, Man, and Cybernetics, Vol. 5, pp , [15] J. Cheng, A Strong Relevant Logic Model of Epistemic Processes in Scientific Discovery, in E. Kawaguchi, H. Kangassalo, H. Jaakkola, and I. A. Hamid (Eds.), Information Modelling and Knowledge Bases XI, pp , IOS Press, [16] J. Cheng, Fuzziness and Relevance: Can We Establish a Unified Logical Basis for Approximate and Relevant Reasoning? Proc. 4th Asian Fuzzy Systems Symposium, pp , [17] J. Cheng, Deontic Relevant Logic as the Logical Basis for Specifying and Reasoning about Information Security and Assurance, Volume of Abstracts of the 12th IUHPS/DLMPS International Congress of Logic, Methodology and Philosophy of Science, pp , [18] J. Cheng, Temporal Relevant Logic as the Logical Basis of Anticipatory Reasoning-Reacting Systems, 6th International Conference on Computing Anticipatory Systems, 2003.

5 [19] F. Cuppens, An Epistemic and Deontic Logic for Reasoning about Computer Security, Proc. 1st European Symposium on Research in Computer Security, pp , [20] M. R. Diaz, Topics in the Logic of Relevance, Philosophia Verlag, [21] F. Dignum and R. Kuiper, Specifying Deadlines with Dense Time Using Deontic and Temporal Logic, International Journal of Electronic Commerce, Vol. 3, pp , [22] J. M. Dunn and G. Restall, Relevance Logic, in: D. Gabbay and F. Guenthner (Eds.), Handbook of Philosophical Logic, 2nd Edition, Vol. 6, pp , Kluwer Academic, [23] J. W. Forrester, Being Good and Being Logical: Philosophical Groundwork for a New Deontic Logic, M. E. Sharpe, [24] D. M. Gabbay, I. Hodkinson, and M. Reynolds, Temporal Logic: Mathematical Foundations and Computational Aspects, Vol. 1, Oxford: Oxford University Press, [25] D. M. Gabbay, M. A. Reynolds, and M. Finger, Temporal Logic: Mathematical Foundations and Computational Aspects, Vol. 2, Oxford: Oxford University Press, [26] A. Galton (Ed.), Temporal Logics and Their Applications, Academic Press, [27] L. Goble, Deontic Logic with Relevance, in P. McNamara and H. Prakken (Eds.), Norms, Logics, and Information Systems, IOS Press, [28] K. Godel, Russell s Mathematical Logic, in Schilpp (Ed.), The Philosophy of Bertrand Russell, Open Court Publishing Company, [29] J. W. Gray and J. D. McLean, Using Temporal Logic to Specify and Verify Cryptographic Protocols (Progress Report), Proc. 8th IEEE Computer Security Foundations Workshop, [30] R. Hilpinen, Deontic Logic, in L. Goble (Ed.), The Blackwell Guide to Philosophical Logic, pp , Blackwell, [31] W. Kneale and M. Kneale, The Development of Logic, Oxford University Press, [32] Z. Manna and A. Pnueli, The Temporal Logic of Reactive and Concurrent Systems: Specification, Springer, [33] Z. Manna and A. Pnueli, Temporal Verification of Reactive Systems: Safety, Springer, [34] E. D. Mares and R. K. Meyer, Relevant Logics, in L. Goble (Ed.), The Blackwell Guide to Philosophical Logic, pp , Blackwell, [35] C. Meadows, Open Issues in Formal Methods for Cryptographic Protocol Analysis, Proc. DISCEX 2000, IEEE Computer Society Press, pp , [36] J.-J. C. Meyer and R. Wieringa (Eds.), Deontic Logic in Computer Science: Normative System Specification, Wiley, [37] J.-J. C. Meyer, R. Wieringa, and F. P. M. Dignum, The Role of Deontic Logic in The Specification of Information Systems, in J. Chomicki and G. Saake (Eds.), Logics for Databases and Information Systems, Kluwer Academic, pp , [38] D. Monniaux, Analysis of Cryptographic Protocols Using Logics of Belief: An Overview, Journal of Telecommunications and Information Technology, Vol. 4, pp , [39] D. Nute (Ed.), Defeasible Deontic Logic, Kluwer Academic, [40] S. Read, Relevant Logic: A Philosophical Examination of Inference, Basil Blackwell, [41] L. M. M. Royakkers, Extending Deontic Logic for the Formalisation of Legal Rules, Kluwer Academic, [42] B. Russell, The Principles of Mathematics, 2nd edition, Cambridge University Press, 1903, 1938, Norton Paperback Edition, Norton, [43] W. Stelzner, Relevant Deontic Logic, Journal of Philosophical Logic, Vol. 21, No. 2, pp , [44] P. Syverson, Adding Time to a Logic of Authentication, Proc. 1st ACM Conference on Computer and Communications Security, [45] P. F. Syverson and I. Cervesato, The Logic of Authentication Protocols, in R. Focardi and R. Gorrieri (Eds.), Foundations of Security Analysis and Design, Lectures Notes in Computer Science, Vol. 2171, pp , Springer-Verlag, [46] P. F. Syverson and C. Meadows, A Logical Language for Specifying Cryptographic Protocol Requirements, Proc IEEE Symposium on Research on Security and Privacy, IEEE Computer Society Press, [47] P. F. Syverson and P. C. van Oorschot, On Unifying Some Cryptographic Protocol Logics, Proc. IEEE Symposium on Research in Security and Privacy, pp , [48] T. Tagawa and J. Cheng, Deontic Relevant Logic: A Strong Relevant Logic Approach to Removing Paradoxes from Deontic Logic, in M. Ishizuka and A. Sattar (Eds.), PRICAI 2002: Trends in Artificial Intelligence, 7th Pacific Rim International Conference on Artificial Intelligence, Lectures Notes in Computer Science, Vol. 2417, pp , Springer-Verlag, [49] A. Tarski, Introduction to Logic and to the Methodology of the Deductive Sciences, 4th Edition, Revised, Oxford University Press, 1941, 1946, 1965, [50] Y. Venema, Temporal Logic, in L. Goble (Ed.), The Blackwell Guide to Philosophical Logic, pp , Blackwell, [51] G. von Wright, Deontic Logic, Mind, Vol. 60, pp. 1-15, [52] G. von Wright, Norm and Action, Routledge & Kegan Paul, 1963.