Curriculum Vitae. Nicolas Stouls

Curriculum Vitae Nicolas Stouls 2 avenue Aristide Briand Phone: (+33) 6.86.62.89.05 38260 La Cote Saint André E-Mail: Nicolas.Stouls@gmail.fr France http://www-lsr.imag.fr/les.personnes/nicolas.stouls/ Date of birth: march 23 th, 1980 in France Nationality: French 1 Education and training 20032007: PhD in Computer Science (Institut National Polytechnique de Grenoble). Title: Formal tools for the specication and the development of systems. Granted during 3 years by CNRS and ST Microelectronics, two months by INP Grenoble and six months by University Paris XI. Supervision by Marie-Laure Potet and Sylvain Boulmé at LSR laboratory (team VASCO, Grenoble, France). End envisaged in June 2007. 20012003: Master degree in Computer Science (Grenoble 1 University) 19972001: Bachelor degree in Computer Science (Grenoble 1 University) 1997: Baccalauréat option mathematics (Lycée Gauguin, French Polynesia) [High School Diploma in Maths] 2 Additional education and training: Magistère The aim of this formation is to prepare students for a PhD. To validate a Magistère degree, student must take a research training course during two or three years in one or more research centres. This diploma must be undertaken in parallel with standard studies (third year of bachelor to second year of Master). 3 rd year (20022003): Study and development of software for the use of B in industrial size projects (Supervised by Daniel Dollé at Siemens Transportation Systems, Montrouge, France). 2 nd year (20012002): Update of the BoB tool (a LSR B tool box) and integration of the weakest precondition calculus (Supervised by Didier Bert at LSR laboratory, team VASCO, Grenoble, France). 1 st year (20002001): Modeling in B of a Java objects interpreter (Supervised by Marie-Laure Potet and Didier Bert at LSR laboratory, team VASCO, Grenoble, France). 1

3 Areas of research My PhD thesis is about the help to understand, document and validate B models [Abr96]. Formal specications are used to develop software in case of great security requirements. To check the conformity between the model and some of these requirements, it is often useful to have several dierent points of view of the same model. Indeed, B models are described in terms of data and treatment. A second view which denes all their behaviours can give a precious help to understand the system. Our approach is based on the generation of symbolic labelled transitions systems which represent behaviours of a B model. Moreover we take into account renement process, which is a way to build model, in progressively introducing requirements. The generation of a symbolic labelled transitions system from a B specication is based on [BC00]. The main originality of this work is the generation of the automaton by resolution of proof obligations. In [5] we precisely describe the transitions labels and we get proof obligations to generate a representation of the B model behaviour. The states space choice changes behaviours representation. Our approach is thus to let the user chooses the states space to focus on any particular property he will. However some works have been done in the team to automatically dene pertinent states space, with dierent technics. Moreover, to obtain a representation as precise as possible, we split the transitions guards in two parts: an enabledness condition and a reachability condition. The rst one denes the condition under which an event can be launched from the start state and the second one denes the condition under which an event can reach the arrived state. Indeed, the enabledness condition is independent of the arrived state. Thus, this representation with two conditions permits to split the proof obligations by factorising the enabledness condition. The produced proof obligations are then easier to automatically be proven and the automaton is then clearer. The renement forms a major part of the development process with the B method. We thus take into account this mechanism to graphically introduce the complexity by steps with the use of hierarchical automata. To retrieve the same main structure as for the abstract representation, we have dened the projection of abstract states through the renement. Projected states are then hierarchically represented as substates of the abstract ones. Next, all transitions have to be re-calculate. But renement properties can be exploited to simplify proof obligations. By example, the enabledness condition of a transition can only be enforced by renement. Then a transition can start from a substate of an abstract state only if the transition can start from the abstract one [5]. Labelled transitions systems permit to express the model behaviours. This information can be useful to validate the correctness of a B specication with respect to security properties. Based on the temporal logic extension for JML proposed in [TH02], we have introduced in [2] a simple modal logic language which permits to express properties as event sequences. This language is based on four primitives: Enabled, Crossable, AlwaysEnabled and AlwaysCrossable. In particular cases, these primitives can be syntactically evaluated on the labelled transitions system extracted from the B model. This method was implemented in a software (GénéSyst) which was used in several projects (see section 4). In particular three case studies were realized and for each of them the use of GénéSyst was helpful: 2

1. The DEMONEY [MM02] JavaCard [BDJ + 01] applet is an electronic purse developed by Trusted Logic. The B model of this applet had been developed from the public requirements and had been used as a case study in EDEN and GECCOO projects. The GénéSyst tool aided in developing the B model and permitted to check the model conformity with respect to the requirements 1. This model also permitted to show some limitations of the tool in front of modular specications, which have to be manually inlined. 2. The B4free web site specication proposed by ClearSy is a model dening rights to download their tool with respect to the product licence (free for industrials which bought the atelierb or for the students and the universities). Because of the form of the model, no states space can permit to see pertinent behaviour to validate the requirements. Then we have focus on the right of a particular user U. With this method the produced automaton allows to follow the behaviours of each person. 3. The network monitor case study [4] is a software which see all communications on a network and have to signal all messages which do not respect the security policy. This development has been done with renement following main TCP/IP network layers. GénéSyst is useful on this example from the second renement level and permits to see the correct save of each security policy violation. However, this model has the property to be more precise in the abstraction than in the rst level of renement. This particular case has shown us some restrictions in our method to project abstract states on the renement. However, this restriction can be pass through by simply conserving all abstract variables in the renement. The GénéSyst 2 [7] tool is based on some external tools: The parser is the JBTools [VTH02] developed in Besançon ; The BoB tool, developed at Grenoble, permits the formulas manipulation to generate the proof obligations ; The automatic prover can be the one from the atelierb or from the B4free tool ; The GraphViz tool [GN99], from the At&T labs, manages the transitions system generation..mch file (+ states) BoB (LSR).HTML file JBTools (LIFC) GénéSyst Intermediate format.gxl file.ref file (+ states) Atelier B (ClearSy).DOT file (GraphViz At&T) 1 Note than the use of GénéSyst during this verication permitted to found two errors in the model. 2 http://www-lsr.imag.fr/les.personnes/nicolas.stouls/ 3

4 Projects Since my rst year of Magistère, I have participated to several projects: RNTL projects (National projects in association with industrials): (1) BOM: B Optimizing Memory, for smartcards' code generation (Partners: Gemplus, LIFC, LSR and ClearSy - 20012003) http://lifc.univ-fcomte.fr/ tatibouet/webbom/ (2) EDEN: Formal validation for Common Criteria highest levels evaluation (Partners: CEA/LIST, VERIMAG, CEA/LETI, SchlumbergerSema and Trusted Logic - 20022005) [TSCL + 02] (3) POSE: Conformity testing of embedded systems' security policies (Partners: AXALTO, LEIRIOS Technologies, SILICOMP-AQL, INRIA/LORIA, LIFC and LSR - 20052007) http://www.rntl-pose.info/ Security ACI projects (National projects based on theoretical research): (4) GECCOO: Certied code generation for object oriented applications. Specication, renement, proof and error detection. (Partners: LIFC, LORIA, INRIA Sophia, LRI, INRIA Futurs and LSR - 20032006) http://geccoo.lri.fr/ (5) POTESTAT: Security policies: Test and test analyse of open networked systems (Partners: LSR, VERIMAG and IRISA - 20042007) http://www-lsr.imag.fr/potestat/ IMAG projects (Between Grenoble's research teams): (6) MODESTE: Modelisation for security: test and renement for certication process (Partners: VERIMAG and LSR - 20042006) http://www-verimag.imag.fr/ lakhnech/modeste/ With these projects I have acquired the following skills: 4.1 B Method (Modelisation, implantation, interactive proof) During my rst years, my job consisted in developing and proving case studies. Then I participated in the development of software based on the B method (BoB 2 and GénéSyst 2 ) before working on security models. I have then acquired some knowledge in writing models easiest to be automatically proved and in using tools like the atelierb (and his interactive prover), the B4free or the click & proof. 4.2 Embedded systems (Smartcards, JavaCard) I have mainly participated in projects oriented in embedded systems. More particularly, they were based on the smartcards and the JavaCard OS. During the BOM project [1, 6] I have developed a part of the JavaCard OS 2 by using the B method. Moreover, the main case study I have developed [2, 5] is a JavaCard applet (DEMONEY 2 ) with his environment (JavaCard OS, terminal and user). Consequently, I have acquired some capabilities about smartcards and APDU protocol. 4

4.3 Security policies (Specication, Checking) The GECCOO project was about embedded systems. Security requirements were then mainly expressed as pre/post conditions (using JML for example) and events sequences [TH02]. In particular, we focused on smartcards requirements mainly based on events sequences [2]. I also studied some security policies for networks with a main focus, toward my case study [4], on restrictive 3 and abstract 4 policies. In our case, the access policy was a set of authorized couples User/Action. 5 Publications International journals [1] F. Badeau, D. Bert, S. Boulmé, C. Métayer, M-L. Potet, N. Stouls et L. Voisin. Adaptabilité et validation de la traduction de B vers C - Points de vue du projet BOM, série TSI 7/2004, Hermès-Lavoisier. International conferences [3] N. Stouls and M-L. Potet. In J. Julliand and O. Kouchnarenko, editors Security Policy Enforcement Through Renement Process, B'2007, the 7th Int. B Conference, LNCS 4355 p.299-318, Springer. [2] D. Bert, M-L. Potet and N. Stouls. GeneSyst: a Tool to Reason about Behavioral Aspects of B Event Specications. Application to Security Properties, LNCS 3455 p.299-318, Springer-Verlag, ZB 2005. French conferences [4] N. Stouls et V. Darmaillacq. Développement formel d'un moniteur détectant les violations de politiques de sécurité de réseaux, AFADL'06 [5] N. Stouls et M-L. Potet. Explicitation du contrôle de développement B événementiel, AFADL 2004 [6] F. Badeau, D. Bert, S. Boulmé, C. Métayer, M-L. Potet, N. Stouls et L. Voisin. Traduction de B vers des langages de programmation, AFADL'03 Posters and short papers [7] X. Morselli, M.-L. Potet et N. Stouls. GénéSyst: Génération d'un système de transitions étiquetées à partir d'une spécication B événementiel, AFADL 2004, tools session. [8] N. Stouls et V. Darmaillacq. Développement formel d'un moniteur, Majecstic 2005. [9] N. Stouls Aide à la spécication et au développement formel de systèmes, 16ième rencontres régionales de la recherche en rhône-alpes 2006 (Poster) Technical reports [10]N. Stouls. Introduction aux cartes à puce, 2006 http://www-lsr.imag.fr/users/nicolas.stouls/productions/cartesapuce/cartesapuce.ps.gz [11]N. Stouls. Introduction aux critères communs, 2004 http://www-lsr.imag.fr/users/nicolas.stouls/productions/cc/criterescommuns.ps.gz 3 All that is not explicitly authorized is forbidden. 4 In terms of high level elements, like users and resources in place of hosts and ports. 5

6 Tools development I participated in the development of two tools: The BoB 2 (Boîte à Outils B - B tool Box) and GénéSyst 2 [2, 5, 7] (Génération de systèmes de transitions étiquetées - Generation of labelled transitions systems). The rst one is a tool developed in Java which permits to manipulate B components and to generate some calculus on them (like the weakest precondition for example). The second one is a tool which takes a B specication and possibly a B renement and which generates a symbolic labelled transitions system which represents the exact behaviour of a given component. 7 Student supervision Hammal Haddad (20042005, Master 2-R)Modelisation and verication of security policies. Xavier Morselli (20032004, Master 1)Verication and optimisation of the GénéSyst tool. Evelyne Altariba (20032004, Master 1)Compression of a B project. Ounaida Mohamed (20032004, Licence 3)Development of a graphical interface for the GénéSyst tool. 8 Teaching Lecturer in B method (20042006) Grenoble 1 university and INP Grenoble (ENSIMAG), Master 1, with Marie-Laure Potet. Introduction to the B method. Software engineering (20062007) Orsay University, IFIPS 2 Introduction to the software engineering in the framework of a training in relation with the industry. Teacher assistant in Software engineering (20062007) Orsay University, Licence 3 Introduction to the software engineering in the framework of a training in relation with the industry. Software engineering project (20062007) Orsay University, Licence 3. A three months project done in parallel with courses, in which each teacher manages several teams of 3 persons. Students had to develop a software by using software engineering methods. Software engineering and compilation project (20042005) INP Grenoble (ENSIMAG), Master 1. A one month project in which each teacher manages 5 teams of 4 persons. Students had to develop a compiler for a language close to ADA. Software engineering and compilation (20042005) Grenoble 1 university, Master 1. A one week project in which students have to develop a compiler for an assembler language. Hardware and Software Architecture (20022004) Grenoble 1 university, Licence 3. An introduction to the hardware architecture and the binary manipulations. 6

Functional programming (20022003) Grenoble 1 university, Licence 2. An introduction to the functional programming with the Caml language. Computer science (20012003) Grenoble 1 university, Licence 1. computer science with the C language. An introduction to the Tutor in mathematics and basic computing (20032004) for a high level sportsman Grenoble 1 university, Licence 1 9 Employments Training course (2003) Research and development of software for the use of B in industrial size projects (Siemens Transportation Systems, Montrouge, France) Computing manager (19981999) (Company ORINA - Papeete, French Polynesia) Network installation, software update, sta training to the Internet and installation of computerized dental radio 10 Responsibilities In charge of the computers park inventory during 3 years. Participation in team web site Participation in PhD. students scientic animation (Seminars, web site) 11 Professional tools Languages: French (mother language) and English (written, spoken and read) Operating systems: LINUX, DOS, Windows, MacOS programming and specication languages: B method, Scheme, Caml, Prolog, Java, ADA, Pascal, C, assemblers,... 12 Awards 2005: Price of the best team spirit in doctoriales of Rhone-Alpes. 1999: In the nal session of PROLOGIN (Individual National Contest of Computing) 1996: Certicate of distinction in Australian Mathematics Competition (Top 15%) 1994: Certicate of credit in Australian Mathematics Competition (Top 50%) 7

13 Professional references Pr Potet Marie-Laure (Marie-Laure.Potet@imag.fr) LSR laboratory, BP72, 38402 St Martin d'hères CEDEX, France Pr Ledru Yves (Yves.Ledru@imag.fr) LSR laboratory, BP72, 38402 St Martin d'hères CEDEX, France Dr Bert Didier (Didier.Bert@imag.fr) LSR laboratory, BP72, 38402 St Martin d'hères CEDEX, France Dr Dollé Daniel (Daniel.Dolle@ts.siemens.fr) Siemens Transportation Systems, 50 rue Barbès, 92542 Montrouge CEDEX, France Pr Amblard Paul (Paul.Amblard@imag.fr) TIMA-CMP, 46 Avenue Félix Viallet, 38031 Grenoble CEDEX, FRANCE References [Abr96] J.R. Abrial. The B-Book. Cambridge University Press, 1996. [BC00] [BDJ + 01] [GN99] [MM02] [TH02] D. Bert and F. Cave. Construction of Finite Labelled Transition Systems from B Abstract Systems. In Integrated Formal Methods, volume 1945 of LNCS. Springer-Verlag, 2000. G. Barthe, G. Dufay, L. Jakubiec, B. Serpette, and S. Melo de Sousa. A Formal Executable Semantics of the JavaCard Platform. Lecture Notes in Computer Science, 2028:302, 2001. E. R. Gannsner and S. C. North. An open graph visualization system and its applications to software engineering. Technical report, Laboratoires AT&T, Etats unis, 26 mai 1999. Renaud Marlet and Cédric Mesnil. Demoney: A demonstrative electronic purse - card specication, 2002. K. Trentelman and M. Huisman. Extending JML Specications with Temporal Logic. In AMAST'02, volume 2422 of LNCS, pages 334348. Springer-Verlag, 2002. [TSCL + 02] TrustedLogic, SchlumbergerSema, CEA-LIST, CEA-LETI, and LSR-IMAG. Description du projet EDEN, février 2002. [VTH02] J.C. Voisinet, B. Tatibouet, and A. Hammad. jbtools: An experimental platform for the formal B method. In PPPJ'02, pages 137140. Trinity College, Dublin, Ireland, Juin 2002. 8