summary writing

profileSuvekshya123.
01-formal-method-model1.pdf

��� ,QIRUPDWLRQ�6HFXULW\

Essay 8

Formal Methods and Models James G. Williams and Marshall D. Abrams

7KH� PRWLYDWLRQ� IRU� XVLQJ� IRUPDO� PHWKRGV� � LQ� WKH� FRQWH[W� RI WUXVWHG�GHYHORSPHQW�VWHPV�SULPDULO\�IURP�WKHLU�DELOLW\�WR�HQVXUH SUHFLVLRQ��FRQVLVWHQF\��DQG�DGGHG�DVVXUDQFH�GXULQJ�WKH�HODERUD� WLRQ�RI�VHFXULW\�UHTXLUHPHQWV��DFURVV�GLIIHUHQW�VWDJHV�LQ�WKH�GHYHO� RSPHQW� RI� D� WUXVWHG� FRPSXWLQJ� V\VWHP�� 7KH� VXEMHFW� PDWWHU� RI IRUPDO�PRGHOV�DQG�VSHFLILFDWLRQV�FDQ�EH�LOOXVWUDWHG�E\�WKH�YDULRXV NLQGV�RI�VHFXULW\�DWWULEXWHV�DQG�UHTXLUHPHQWV�WKDW�KDYH�WXUQHG�XS LQ� SXEOLVKHG� VHFXULW\� PRGHOV�� ([DPSOHV� GLVFXVVHG� LQ� WKLV� HVVD\ UHODWH�WR�QRQGLVFORVXUH�SROLFLHV��GDWD�LQWHJULW\�SROLFLHV��DQG�XVHU� FRQWUROOHG� SROLFLHV�� 7KLV� HVVD\� FRQFOXGHV� ZLWK� D� GLVFXVVLRQ� RI WHFKQLFDO�DQG�PHWKRGRORJLFDO�LVVXHV�UHODWLQJ�WR�WKH�HIIHFWLYH�XVH�RI IRUPDO�PHWKRGV�

:KLOH�LW�LV�DSSHDOLQJ�WR�DSSURDFK�VHFXULW\�LQWXLWLYHO\��LW�LV�LPSRUWDQW�WR UHFRJQL]H�WKDW�PDQ\�´JRRG�LGHDVµ�WXUQ�RXW�WR�EH�QRW�VR�JRRG�XSRQ�FORVH LQVSHFWLRQ�� 7KLV� HVVD\� LV� FRQFHUQHG� ZLWK� VHYHUDO� ZD\V� WR� LQFUHDVH� WKH SUREDELOLW\�WKDW�WKH�WUXVW�SODFHG�LQ�DQ�automated information system��$,6��LV MXVWLILHG��,W�GLVFXVVHV�D�VHW�RI�DSSURDFKHV�GHVFULEHG�DV�IRUPDO��LQFOXGLQJ PRGHOV�ZULWWHQ�LQ�D�IRUPDO�QRWDWLRQ�DQG�WKH�XVH�RI�IRUPDO�SURRIV� ,Q� WKH� FRQWH[W� RI� LQIRUPDWLRQ� VHFXULW\�� IRUPDO� PHWKRGV� LPSO\� XVH� RI

VSHFLDOL]HG�ODQJXDJH�DQG�UHDVRQLQJ�WHFKQLTXHV��,QIRUPDO�PHWKRGV��E\�ZD\ RI�FRQWUDVW��DUH�FRXFKHG�LQ�QDWXUDO�ODQJXDJH�DQG�UHO\�RQ�FRPPRQ�VHQVH� 7KH�XVH�RI�D�IRUPDO�QRWDWLRQ��HVSHFLDOO\�RQH�ZLWK�D� ZHOO�XQGHUVWRRG� VH� PDQWLFV��FDQ�LPSURYH�WKH�SUHFLVLRQ�ZLWK�ZKLFK�D�VHFXULW\�SROLF\�LV�VWDWHG� 7KH�XVH�RI�IRUPDO�SURRIV�FDQ�SURYLGH�DGGHG�DVVXUDQFH�WKDW�VSHFLILHG�SRO� LF\�HQIRUFHPHQW� WHFKQLTXHV� VXFFHHG� LQ� VDWLVI\LQJ� D� IRUPDO� GHILQLWLRQ� RI VHFXULW\��)RUPDO�PHWKRGV�DQG�SURRIV�DUH�UHTXLUHG�E\�WKH�7&6(&�IRU�V\V� WHPV�UDWHG�%��DQG�DERYH� %\� ZD\� RI� LQWURGXFWLRQ�� ZH� ILUVW� GLVFXVV� WKH� PRWLYDWLRQ� IRU� IRUPDO

PHWKRGV��DQG�WKHQ�ZH�ORRN�DW�WKHLU�DSSOLFDWLRQ�GXULQJ�WKH�FRQVWUXFWLRQ�RI VHFXUH�V\VWHPV�

)RUPDO�0HWKRGV�DQG�0RGHOV ���

'RLQJ�WKH�´ULJKW�WKLQJµ

+RZ�LV�RQH�FRQYLQFHG�WKDW�D�V\VWHP�GRHV�WKH�´ULJKW�WKLQJµ"�7KHUH�FRXOG EH� PDQ\� FRQWULEXWLQJ� IDFWRUV�� VXFK� DV� WKH� UHSXWDWLRQV� RI� WKH� KDUGZDUH DQG� VRIWZDUH� YHQGRUV�� VRPH� GHJUHH� RI� WHVWLQJ�� DQG� SULRU� H[SHULHQFH�� ,Q WKH�FDVH�RI�FRPSXWHU�VHFXULW\��WKHVH�IDFWRUV�DUH�IUHTXHQWO\�QRW�VXIILFLHQW� 7KH�VHFXULW\�IHDWXUHV�RI�D�FRPSXWLQJ�V\VWHP�DUH�RIWHQ�FRQVLGHUHG�WR�EH FULWLFDO� V\VWHP� IXQFWLRQV� ZKRVH� FRUUHFWQHVV� PXVW� EH� DVVXUHG� WR� D� KLJK GHJUHH� EHFDXVH� WKH� FRQVHTXHQFHV� RI� IDLOXUH� DUH� XQDFFHSWDEOH�� <HW� ZH NQRZ� IURP� H[SHULHQFH� WKDW� ODWHQW� VHFXULW\� IODZV� LQ� RSHUDWLQJ� V\VWHP PRGXOHV�RU�LQ�WKH�V\VWHP·V�XQGHUO\LQJ�KDUGZDUH�FDQ�FDXVH�WURXEOH�DIWHU \HDUV�RI�XVH� ,Q�JHQHUDO��LQDGHTXDFLHV�LQ�D�V\VWHP�FDQ�UHVXOW�HLWKHU�IURP�D�IDLOXUH�WR

XQGHUVWDQG� UHTXLUHPHQWV� RU� IURP� IODZV� LQ� WKHLU� LPSOHPHQWDWLRQ�� 7KH IRUPHU�SUREOHP��GHILQLQJ�ZKDW�D�V\VWHP�VKRXOG�GR��LV�UHODWLYHO\�GLIILFXOW LQ�WKH�FDVH�RI�VHFXULW\��VR�WKH�GHILQLWLRQ�KDV�WR�EH�XQXVXDOO\�SUHFLVH�DQG ZHOO�XQGHUVWRRG��0RUHRYHU��VXEWOH�IODZV�FDQ�VKRZ�XS�DW�DQ\�VSRW�ZKHUH WKH�V\VWHP�GHVLJQ�KDV�OHIW�D�ORRSKROH��VR�WKH�GHILQLWLRQ�PXVW�EH�IDLWKIXOO\ UHIOHFWHG� GRZQ� WKURXJK� DOO� WKH� YDULRXV� VWDJHV� RI� UHTXLUHPHQWV� DQDO\VLV� GHVLJQ��DQG�LPSOHPHQWDWLRQ�>*$66����6HF���@� $�SULPDU\�VWUDWHJ\�IRU�DVVXULQJ�VHFXULW\�LV�WR�SURYLGH�D�VHFXULW\�SROLF\

PRGHO� WKDW� VLPXOWDQHRXVO\� PRGHOV� ERWK� D� VHFXULW\� SROLF\� DQG� DQ� $,6� 6XFK� D� PRGHO� FRQVLVWV� RI� WZR� VXEPRGHOV�� D� GHILQLWLRQ� RI� VHFXULW\� WKDW FDSWXUHV�WKH�VHFXULW\�SROLF\��DQG�UXOHV�RI�RSHUDWLRQ�WKDW�VKRZ�KRZ�WKH�$,6 HQIRUFHV� WKH� GHILQLWLRQ� RI� VHFXULW\�� ,Q� WKH� FDVH� RI� D� IRUPDO� PRGHO�� LW� LV SRVVLEOH�WR�EH�TXLWH�SUHFLVH�LQ�VWDWLQJ�WKH�GHILQLWLRQ�RI�VHFXULW\�DQG�WR�ULJ� RURXVO\�SURYH�WKDW�WKH�UXOHV�RI�RSHUDWLRQ�JXDUDQWHH�WKDW�WKH�GHILQLWLRQ�RI VHFXULW\� ZLOO� EH� VDWLVILHG�� ,Q� VRPH� IRUPDOL]DWLRQV�� LQLWLDO�VWDWH� DVVXPS� WLRQV�DQG�UXOHV�RI�RSHUDWLRQ�DUH�WUHDWHG�DV�D[LRPV��,Q�WKLV�FDVH��WKH�GHIL� QLWLRQ�RI�VHFXULW\�EHFRPHV�D�WKHRUHP�RI�WKH�UHVXOWLQJ�WKHRU\��LQ�DGGLWLRQ WR�GHILQLQJ�WKH�PRGHOHG�SRUWLRQ�RI�WKH�VHFXULW\�SROLF\�

6WDJHV�RI�HODERUDWLRQ�LQ�WKH�FUHDWLRQ�RI�D�VHFXUH�V\VWHP��7R�JDLQ�D PRUH�GHWDLOHG�XQGHUVWDQGLQJ�RI�WKH�UROH�RI� IRUPDO� PHWKRGV�� LW� LV� QHFHV� VDU\�WR�LQYHVWLJDWH�WKH�YDULRXV�VWDJHV�LQ�WKH�GHYHORSPHQW�RI�D�VHFXUH�$,6� DV�SLFWXUHG�LQ�)LJXUH��� +LJK�OHYHO�SROLF\�REMHFWLYHV�VSHFLI\�ZKDW�LV�WR�EH�DFKLHYHG�E\�SURSHU�GH�

VLJQ�DQG�XVH�RI�D�FRPSXWLQJ�V\VWHP��WKH\�FRQVWUDLQ�WKH�UHODWLRQVKLS�EH� WZHHQ� WKH� V\VWHP� DQG� LWV� HQYLURQPHQW�� +LJKHU�OHYHO� VHFXULW\� REMHFWLYHV IRU�WKH�XVH�RI�'R'�FRPSXWLQJ�V\VWHPV�KDYH�EHHQ�JLYHQ�LQ�'R'�'LUHFWLYH ��������� ´6HFXULW\� 5HTXLUHPHQWV� IRU� $XWRPDWHG� ,QIRUPDWLRQ� 6\VWHPV �$,6V�µ�>'2'��D@��2EMHFWLYHV�UHODWLQJ�WR�WKH�GLVFORVXUH�RI�FODVVLILHG�LQIRU� PDWLRQ�VWHP�IURP�([HFXWLYH�2UGHU�������>5($*��@�DQG�FDQ�EH�IRXQG�LQ �������5�>'2'��@�DQG�LQ�WKH�7&6(&�´FRQWURO�REMHFWLYHV�µ�&ODVVLILHG�DQG RWKHU�VHQVLWLYH�LQIRUPDWLRQ�QHHGHG�IRU�WKH�FRQGXFW�RI�IHGHUDO�SURJUDPV�LV

��� ,QIRUPDWLRQ�6HFXULW\

SURWHFWHG� E\� WKH� &RPSXWHU� 6HFXULW\� $FW� RI� ����� >&21*��@�� ZKLFK� UH� TXLUHV� VDIHJXDUGV� DJDLQVW� ORVV� DQG� XQDXWKRUL]HG� PRGLILFDWLRQ�� 7KH� FRO� OHFWLRQ��PDLQWHQDQFH��XVH��DQG�GLVVHPLQDWLRQ�RI�SHUVRQDO�LQIRUPDWLRQ�DUH SURWHFWHG�E\�'R'�'LUHFWLYH���������>'2'������(��@��E\�WKH�3ULYDF\�$FW�RI �����>&21*��@��DQG�E\�WKH�&RPSXWHU�0DWFKLQJ�DQG�3ULYDF\�3URWHFWLRQ $FW� >&21*���� &21*��@�� 6HFXULW\� REMHFWLYHV� IRU� IHGHUDO� V\VWHPV� KDYH EHHQ�HQXPHUDWHG�E\�WKH�86�&RQJUHVV�>&21*��@��*RYHUQPHQW�$FFRXQW� LQJ� 2IILFH� >*$2��@�� DQG� 2IILFH� RI� 0DQDJHPHQW� DQG� %XGJHW� >20%��� 20%��@�� 6HFXULW\� REMHFWLYHV� IRU� FRPPHUFLDO� V\VWHPV� KDYH� EHHQ� DUWLFX� ODWHG� E\� &ODUN� DQG� :LOVRQ� >&/$5���� &/$5��E@�� )LQDOO\�� VLWH�GHSHQGHQW RUJDQL]DWLRQDO�VHFXULW\�SROLFLHV�PD\�DOVR�FRQWULEXWH�REMHFWLYHV�IRU�WKH�GH� VLJQ�DQG�XVH�RI�D�VHFXUH�FRPSXWLQJ�V\VWHP�

Figure 1. Stages of elaboration.

$Q� H[WHUQDO�LQWHUIDFH� UHTXLUHPHQW� DSSOLHV� D� KLJKHU�OHYHO� REMHFWLYH� WR� D FRPSXWLQJ�V\VWHP·V�H[WHUQDO�LQWHUIDFH��LW�H[SODLQV�ZKDW�FDQ�EH�H[SHFWHG IURP� WKH� V\VWHP� LQ� VXSSRUW� RI� WKH� REMHFWLYH� EXW� GRHV� QRW� XQGXO\� FRQ� VWUDLQ�LQWHUQDO�V\VWHP�VWUXFWXUH��7KH�*RJXHQ�0HVHJXHU�QRQLQWHUIHUHQFH PRGHO�LV�SHUKDSV�WKH�EHVW�NQRZQ�H[DPSOH�RI�D�IRUPDO�H[WHUQDO�LQWHUIDFH UHTXLUHPHQW�>*2*8����*2*8��@��9DULRXV�GHULYDWLYHV�RI�WKLV�PRGHO�KDYH EHHQ�DGYDQFHG�LQ�VXSSRUW�RI�'R'�QRQGLVFORVXUH�REMHFWLYHV��7KH\�VD\��HV� VHQWLDOO\��WKDW�RXWSXWV�IURP�D�V\VWHP�DW�D�JLYHQ�QRQGLVFORVXUH�OHYHO�PXVW QRW�GHSHQG�RQ�LQSXWV�DW�D�KLJKHU�RU�LQFRPSDUDEOH�OHYHO� ,QWHUQDO�UHTXLUHPHQWV�FRQVWUDLQ�UHODWLRQVKLSV�DPRQJ�V\VWHP�HQWLWLHV�RU

FRPSRQHQWV�� 7KH� trusted computing base� �7&%�� HPHUJHV� DW� WKLV� VWDJH� RI

)RUPDO�0HWKRGV�DQG�0RGHOV ���

HODERUDWLRQ��LW�FRQWDLQV�WKRVH�SRUWLRQV�RI�WKH�V\VWHP�ZKLFK�PXVW�EH�FRQ� VWUDLQHG�WR�VXSSRUW�WKH�KLJKHU�OHYHO�REMHFWLYHV�DQG�DFKLHYH�WKH�H[WHUQDO� LQWHUIDFH� UHTXLUHPHQWV�� %HOO� DQG� /D3DGXOD·V� VLPSOH�VHFXULW\� SURSHUW\� LV DQ�H[DPSOH�RI�DQ�LQWHUQDO�UHTXLUHPHQW��LW�VD\V��HVVHQWLDOO\��WKDW�D�VXEMHFW PD\�KDYH�UHDG�DFFHVV�WR�DQ�REMHFW�RQO\�LI�WKH�VHFXULW\�OHYHO�RI�WKH�VXEMHFW GRPLQDWHV�WKH�VHFXULW\�OHYHO�RI�WKH�REMHFW�>%(//��@��)RUPDO�GHILQLWLRQV�RI VHFXULW\�XVXDOO\�FRQWDLQ�D�FRPELQDWLRQ�RI�LQWHUQDO�DQG�H[WHUQDO�LQWHUIDFH UHTXLUHPHQWV��7KH\�DUH�JLYHQ�DV�D�IRUPDOL]DWLRQ�RI�D�V\VWHP�VHFXULW\�SRO� LF\�WKDW�VSHFLILHV�KRZ�DQ�$,6�KHOSV�SUHYHQW�LQIRUPDWLRQ�DQG�FRPSXWLQJ UHVRXUFHV�IURP�EHLQJ�XVHG�WR�YLRODWH�D�FRUUHVSRQGLQJ�RUJDQL]DWLRQDO�VHFX� ULW\�SROLF\�>67(5��@� 5XOHV� RI� RSHUDWLRQ� H[SODLQ� KRZ� LQWHUQDO� UHTXLUHPHQWV� DUH� HQIRUFHG� E\

VSHFLI\LQJ�DFFHVV�FKHFNV�DQG�UHODWHG� EHKDYLRUV� WKDW� JXDUDQWHH� VDWLVIDF� WLRQ�RI�WKH�LQWHUQDO�UHTXLUHPHQWV��$�top-level specification��7/6���OLNH�UXOHV RI� RSHUDWLRQ�� VSHFLILHV� WKH� EHKDYLRU� RI� V\VWHP� FRPSRQHQWV� RU� FRQWUROOHG HQWLWLHV��EXW�LW�LV�D�PRUH�FRPSOHWH�IXQFWLRQDO�GHVFULSWLRQ�RI�WKH�7&%�LQ� WHUIDFH��7KHUH�LV� QR� ILUP� ERXQGDU\� EHWZHHQ� UXOHV� RI� RSHUDWLRQ� DQG� WRS� OHYHO�VSHFLILFDWLRQV��%RWK�H[SODLQ�KRZ�LQWHUQDO�UHTXLUHPHQWV�DUH�HQIRUFHG E\�WKH�7&%��EXW�PRUH�GHWDLO�LV�UHTXLUHG�LQ�D�7/6��LQFOXGLQJ�DFFXUDWH�GH� VFULSWLRQV�RI�WKH�HUURU�PHVVDJHV��H[FHSWLRQV��DQG�HIIHFWV�RI�WKH�7&%�LQ� WHUIDFH��,Q�GHVLJQLQJ�UXOHV�RI�RSHUDWLRQ��LW�PD\�EH�FRQYHQLHQW�WR�VHSDUDWH DFFHVV�GHFLVLRQV�IURP�RWKHU�NLQGV�RI�V\VWHP�IXQFWLRQDOLW\��LQFOXGLQJ�WKH DFWXDO�HVWDEOLVKPHQW�RU�UHPRYDO�RI�DFFHVV��7KLV�VHSDUDWLRQ�IDFLOLWDWHV�WKH H[SORUDWLRQ�RI�QHZ�DFFHVV�FRQWURO�SROLFLHV��2IWHQ��RQO\�WKH�DFFHVV�GHFLVLRQ SRUWLRQ�LV�DIIHFWHG�E\�D�FKDQJH�LQ�SROLF\�EHFDXVH�DFFHVV�HQIRUFHPHQW�GH� SHQGV� RQO\� RQ� WKH� DFFHVV� GHFLVLRQ�� QRW� RQ� KRZ� LW� ZDV� PDGH� >/$3$��� $%5$��@��,VRODWLRQ�RI�WKH�DFFHVV�GHFLVLRQ�PHFKDQLVP�RFFXUV�LQ�WKH�/2&. V\VWHP� GHVLJQ� >6$<'��@� DQG� LQ� WKH� VHFXULW\� SROLF\� DUFKLWHFWXUH� RI� 6H� FXUH:DUH·V�&RPSDUWPHQWHG�0RGH�:RUNVWDWLRQ�>1&6&��E��6HF�������@� )LQDOO\��GHSHQGLQJ�RQ�WKH�GHYHORSPHQW�PHWKRGRORJ\��WKHUH�PD\�EH�VHY�

HUDO�ORZHU�OHYHOV�RI�V\VWHP�GHVFULSWLRQ��HQGLQJ�DW�WKH�OHYHO�RI�H[HFXWDEOH FRGH�DQG�KDUGZDUH�GLDJUDPV�

&RUUHFWQHVV� RI� HODERUDWLRQ�� 7KH� DSSURSULDWHQHVV� �DV� RSSRVHG� WR� FRU� UHFWQHVV��RI�KLJKHU�OHYHO�REMHFWLYHV�IRU�WKH�GHVLJQ�RI�D�FRPSXWLQJ�V\VWHP LV� GHWHUPLQHG� E\� H[SHULHQFH�� 2EMHFWLYHV� DUH� DSSURSULDWH� LI� WKH\� FRXQWHU VHFXULW\� WKUHDWV� DQG� DUH� DFKLHYDEOH�� 6HFXULW\� REMHFWLYHV� DUH� VHOGRP� IRU� PDOL]HG�� 7KH� DGHTXDF\� RI� D� V\VWHP� VHFXULW\� SROLF\� LV� DOVR� D� PDWWHU� RI MXGJPHQW��:KHWKHU�D�V\VWHP�VHFXULW\�SROLF\�LV�DGHTXDWH�SOD\V�D�NH\�UROH LQ� WKH� VXFFHVVIXO� HQIRUFHPHQW� RI� DQ� RUJDQL]DWLRQDO� VHFXULW\� SROLF\�� ,Q FRQWUDVW� WR� REMHFWLYHV�� WKH� DGHTXDF\� RI� D� V\VWHP� VHFXULW\� SROLF\� FDQ� EH VXSSRUWHG� WKURXJK� WKH� XVH� RI� HQJLQHHULQJ� DUJXPHQWV� VKRZLQJ� KRZ� WKH V\VWHP�SROLF\�FRPELQHV�ZLWK�FRQVWUDLQWV�RQ�WKH�V\VWHP·V�XVH�DQG�HQYL� URQPHQW�WR�DFKLHYH�WKH�LGHQWLILHG�REMHFWLYHV��6XFK�DQ�DUJXPHQW�PD\�EH VLPSOHU�DQG�PRUH�SHUVXDVLYH�LI�WKH�V\VWHP�VHFXULW\�SROLF\�LV�FDVW�LQ�WHUPV

��� ,QIRUPDWLRQ�6HFXULW\

RI�H[WHUQDO�LQWHUIDFH�UHTXLUHPHQWV��7KH�IRUPDO�GHILQLWLRQ�RI�VHFXULW\�PXVW DOVR�EH�LQIRUPDOO\�GHPRQVWUDWHG�WR�VXFFHVVIXOO\�FRGLI\�WKH�V\VWHP�VHFX� ULW\� SROLF\�� )RU� VXFK� D� GHPRQVWUDWLRQ� WR� EH� SRVVLEOH�� LW� LV� QHFHVVDU\� WR DVVLJQ�UHDO�ZRUOG�LQWHUSUHWDWLRQV�WR�WKH�NH\�FRQVWUXFWV�LQ�WKH�IRUPDO�GHIL� QLWLRQ� ,I�WKH�GHILQLWLRQ�RI�VHFXULW\�LV�FDVW�DW�WKH�V\VWHP�OHYHO��LQ�WHUPV�RI�IRU�

PDO�H[WHUQDO�LQWHUIDFH�UHTXLUHPHQWV��WKHQ�WKH�FRUUHFWQHVV�RI�LQWHUQDO�UH� TXLUHPHQWV�FDQ�EH�IRUPDOO\�SURYHQ��7KH�7&%�LV�ODUJHO\�GHWHUPLQHG�E\�WKH HODERUDWLRQ�RI�LQWHUQDO�UHTXLUHPHQWV��,I�WKH�DGHTXDF\�RI�WKH�V\VWHP�VHFX� ULW\� SROLF\� LV� EDVHG� RQ� H[WHUQDO�LQWHUIDFH� UHTXLUHPHQWV�� WKHQ� WKH� WUXVW� ZRUWKLQHVV� RI� WKH� 7&%� LV� HVWDEOLVKHG� E\� UHTXLULQJ� LW� WR� FRQWDLQ� WKRVH SRUWLRQV�RI�WKH�V\VWHP�ZKRVH�IXQFWLRQDOLW\�PXVW�EH�FRQVWUDLQHG�WR�SURYH WKH�H[WHUQDO�LQWHUIDFH�UHTXLUHPHQWV��1RWLFH�WKDW�WKH�7&%�HQIRUFHV�RQO\�D V\VWHP�VHFXULW\�SROLF\��(QIRUFHPHQW�RI�WKH�FRUUHVSRQGLQJ�RUJDQL]DWLRQDO SROLF\�GHSHQGV�MRLQWO\�RQ�PHFKDQLVPV�ZLWKLQ�WKH�7&%��RQ�WKH�FRUUHFW�LQ� SXW�E\�V\VWHP�DGPLQLVWUDWLYH�SHUVRQQHO�RI�SDUDPHWHUV�RI�WKH�V\VWHP�VH� FXULW\�SROLF\��IRU�H[DPSOH��D�XVHU·V�FOHDUDQFH���DQG�RQ�WKH�SURSHU�DFWLRQV RI�XVHUV��SURSHU�ODEHOLQJ�RI�LQSXW��SDVVZRUG�VHFUHF\��DQG�VR�RQ�� 5XOHV�RI�RSHUDWLRQ�DUH�QRUPDOO\�YHULILHG�E\�VKRZLQJ�WKDW�WKH\�JXDUDQWHH

VDWLVIDFWLRQ�RI�WKH�LQWHUQDO�UHTXLUHPHQWV��7KLV�LV�D�UHODWLYHO\�VWUDLJKWIRU� ZDUG� PDWKHPDWLFDO� HIIRUW�� $� formal top-level specification� �)7/6�� FDQ� EH YHULILHG� HLWKHU� E\� SURYLQJ� VDWLVIDFWLRQ� RI� LQWHUQDO� UHTXLUHPHQWV� RU� E\ SURYLQJ�WKDW�WKH�)7/6�LV�FRQVLVWHQW�ZLWK�WKH�UXOHV�RI�RSHUDWLRQ� )RUPDO�DVVXUDQFH�LV�QRW�RIWHQ�DSSOLHG�WR�ODWHU�VWDJHV�RI�HODERUDWLRQ��GXH

WR� FRVW� FRQVWUDLQWV�� &RUUHFWQHVV� RI� WKH� LPSOHPHQWDWLRQ� LWVHOI� LV� HVWDE� OLVKHG� LQIRUPDOO\� ZLWK� WKH� KHOS� RI� PRGHUQ� KLJK�OHYHO� ODQJXDJHV�� VWUXF� WXUHG� ZDON�WKURXJKV�� DQG� WHVWLQJ�� 'XULQJ� WKHVH� ODWHU� VWDJHV�� LW� LV HVVHQWLDO�WR�LQFOXGH�LQ�WKH�7&%�DOO�FRGH�QHHGHG�WR�VXSSRUW�WKH�7&%�IXQF� WLRQDOLW\�LGHQWLILHG�DW�KLJKHU�OHYHOV���$W�ZKDWHYHU�SRLQW�IRUPDO�DVVXUDQFH VWRSV�� WKHUH� PXVW� EH� D� WUDQVLWLRQ� IURP� PDWKHPDWLFV� EDFN� WR� UHDO�ZRUOG FRQFHSWV��WKH�WUDQVLWLRQ�UHTXLUHV�SK\VLFDO�LQWHUSUHWDWLRQV�IRU�DOO�NH\�FRQ� FHSWV�LQ�WKH�IRUPDO�VSHFLILFDWLRQ��7KHVH�SK\VLFDO�LQWHUSUHWDWLRQV�PXVW�EH FRQVLVWHQW�ZLWK�WKRVH�XVHG�WR�HVWDEOLVK�WKH�DGHTXDF\�RI�WKH�PRGHO·V�GHIL� QLWLRQ�RI�VHFXULW\�

)RUPDO�VHFXULW\�PRGHOV

7KLV�VHFWLRQ�ORRNV�ILUVW�DW�WKH�EDVLF�FRQFHSWV�WKDW�WXUQ�XS�LQ�VHFXULW\ PRGHOV��WKHQ�DW�NH\�GLVWLQFWLRQV�DPRQJ�YDULRXV�NLQGV�RI�VHFXULW\�PRGHOV� DQG�ILQDOO\�DW�KRZ�WKHVH�FRQFHSWV�DQG�GLVWLQFWLRQV�DUH�UHIOHFWHG�LQ�ZHOO� NQRZQ�H[DPSOHV�

��������������������������������������������� �7KH�FRQWHQWV�RI�WKH�7&%�PLJKW�LQFUHDVH�IRU�RWKHU�UHDVRQV�DV�ZHOO�>6&+$���

6HF���������@�

)RUPDO�0HWKRGV�DQG�0RGHOV ���

%DVLF�FRQFHSWV�WR�EH�PRGHOHG��$�VHFXUH� FRPSXWLQJ� V\VWHP� PD\� GH� FRPSRVH� LQWR� GDWD� VWUXFWXUHV�� SURFHVVHV�� LQIRUPDWLRQ� DERXW� XVHUV�� ,�2 GHYLFHV�� DQG� VHFXULW\� DWWULEXWHV� IRU� FRQWUROOHG� HQWLWLHV�� 7KH� IROORZLQJ SDUDJUDSKV�GLVFXVV�WKLV�GHFRPSRVLWLRQ�LQ�OLJKW�RI�WKH�QHHG�IRU�DFFXUDWH SK\VLFDO�LQWHUSUHWDWLRQV�RI�PRGHO�FRQVWUXFWV� $V� GLVFXVVHG� HDUOLHU�� WKH� LGHQWLILFDWLRQ� RI� FRQWUROOHG� HQWLWLHV� SOD\V� D

FUXFLDO�UROH�LQ� WKH� GHYHORSPHQW� RI� D� VHFXULW\� SROLF\� PRGHO�� )RU� V\VWHPV ZLWK�D�7&6(&�HYDOXDWLRQ�RI�%��RU�DERYH��WKH�FRQWUROOHG�HQWLWLHV�PXVW�LQ� FOXGH�DOO�V\VWHP�UHVRXUFHV��$Q�H[SOLFLWO\�FRQWUROOHG�HQWLW\�LV�RQH�WKDW�KDV H[SOLFLWO\� DVVRFLDWHG� VHFXULW\� DWWULEXWHV�� ,Q� DGGLWLRQ� WR� H[SOLFLWO\� FRQ� WUROOHG�HQWLWLHV��D�V\VWHP�ZLOO�KDYH�LPSOLFLWO\�FRQWUROOHG�HQWLWLHV��6XFK�DQ HQWLW\�PLJKW�EH�FRQWDLQHG�LQ�DQ�H[SOLFLWO\�FRQWUROOHG�HQWLW\�RU�PLJKW�EH�D FRPSRVLWH�HQWLW\�FRQWDLQLQJ�VHYHUDO�H[SOLFLWO\�FRQWUROOHG�HQWLWLHV�ZLWK�GLI� IHULQJ�VHFXULW\�DWWULEXWHV� $�GDWD�VWUXFWXUH�LV�D�UHSRVLWRU\�IRU�GDWD�ZLWK�DQ�LQWHUQDO�VWDWH��RU�YDOXH�

WKDW�FDQ�EH�ZULWWHQ��FKDQJHG��DQG�RU�UHDG��REVHUYHG��E\�SURFHVVHV��DQG SRVVLEO\�GHYLFHV��XVLQJ�ZHOO�GHILQHG�RSHUDWLRQV�DYDLODEOH�WR�WKHP��$�GDWD VWUXFWXUH�WKDW�LV�DOVR�D�PLQLPDO��H[SOLFLWO\�FRQWUROOHG�HQWLW\�LV�D�VWRUDJH REMHFW�� 6HFXULW\� DWWULEXWHV� RI� VWRUDJH� REMHFWV� PD\� LQFOXGH� VHFXULW\� OHYHO DQG�XVHU�DFFHVV� SHUPLVVLRQV� �DFFHVV� SHUPLVVLRQV� EDVHG� RQ� XVHU� LGHQWL� WLHV�� JURXSV�� DQG�RU� UROHV��� ,Q� D� PRGHO� WKDW� LQFOXGHV� VHFXULW\� OHYHOV�� D VWRUDJH�REMHFW�KDV�D�XQLTXH�VHFXULW\�OHYHO��DV�D�UHVXOW�RI�PLQLPDOLW\��6WRU� DJH�REMHFWV�PD\�EH�FRPELQHG�WR�IRUP�PXOWLOHYHO�GDWD�VWUXFWXUHV�WKDW�DUH DVVLJQHG� WKHLU� RZQ� VHFXULW\� OHYHOV�� 0XOWLOHYHO� GDWD� VWUXFWXUHV� FDOOHG ´FRQWDLQHUVµ�DUH�XVHG�LQ�WKH�6HFXUH�0LOLWDU\�0HVVDJH�6\VWHP��6006��WR DGGUHVV�DJJUHJDWLRQ�SUREOHPV��>/$1'��@��WKH�OHYHO�RI�D�FRQWDLQHU�LV� UH� TXLUHG�WR�GRPLQDWH�WKH�OHYHOV�RI�DQ\�REMHFWV�RU�FRQWDLQHUV�LQVLGH�LW� $� SURFHVV� PD\� FUHDWH�� GHVWUR\�� DQG� LQWHUDFW� ZLWK� VWRUDJH� REMHFWV� DQG

RWKHU�SURFHVVHV��DQG�LW�PD\�LQWHUDFW�ZLWK�,�2�GHYLFHV��,W�KDV�DQ�DVVRFL� DWHG�UXQWLPH�HQYLURQPHQW�DQG�LV�GLVWLQFW�IURP�WKH�SURJUDP�RU�FRGH�WKDW GHILQHV�LW��$Q�H[SOLFLWO\�FRQWUROOHG�SURFHVV�LV�D�VXEMHFW��,W�QRUPDOO\�KDV�D YDULHW\� RI� DVVRFLDWHG� VHFXULW\� DWWULEXWHV�� LQFOXGLQJ� SHUKDSV� D� VHFXULW\ OHYHO��KDUGZDUH�VHFXULW\�DWWULEXWHV�VXFK�DV�LWV�SURFHVV�GRPDLQ��WKH�XVHU DQG�XVHU�JURXS�RQ�ZKRVH�EHKDOI�LW�LV�H[HFXWLQJ��LQGLFDWLRQV�RI�ZKHWKHU�LW EHORQJV�WR�WKH�7&%��DQG��LQ�WKLV�FDVH��LQGLFDWLRQV�RI�ZKHWKHU�LW�LV�H[HPSW IURP�FHUWDLQ�DFFHVV�FRQWURO�FKHFNV��,Q�JHQHUDO��WKH�VHFXULW\�UHOHYDQW�DW� WULEXWHV�RI�D�VXEMHFW�DUH�SDUW�RI�LWV�UXQWLPH�HQYLURQPHQW� 8VHU�UHODWHG� LGHDV� RIWHQ� WXUQ� XS� LQ� VHFXULW\� PRGHOV�� GHVSLWH� WKH� IDFW

WKDW�XVHUV�DUH�QRW�FRQWUROOHG�HQWLWLHV�DQG�DUH�QRW�GLUHFWO\�DGGUHVVHG�LQ�D V\VWHP�VHFXULW\�SROLF\��7KH�XVHUV�RI�D�V\VWHP�PD\�SHUIRUP�VSHFLILF�XVHU UROHV� E\� H[HFXWLQJ� DVVRFLDWHG� UROH�VXSSRUW� SURJUDPV�� ,Q� JHQHUDO�� D� XVHU PD\�KDYH�D�FRPELQDWLRQ�RI�VHYHUDO�UROHV��$V�D�PDWWHU�RI�SROLF\��D�JLYHQ ��������������������������������������������� �$Q�DJJUHJDWLRQ�SUREOHP�FDQ�RFFXU�ZKHQ�D�XVHU�KDV�DFFHVV�WR�LQGLYLGXDO�SLHFHV

RI�GDWD�LQ�D�GDWD�VHW��EXW�QRW�WR�WKH�HQWLUH�GDWD�VHW�

��� ,QIRUPDWLRQ�6HFXULW\

XVHU� UROH� PD\� UHTXLUH� V\VWHP�PHGLDWHG� DXWKRUL]DWLRQ� DQG� PD\� SURYLGH VSHFLILF�V\VWHP�UHVRXUFHV�QHHGHG�IRU�SHUIRUPDQFH�RI�WKH�UROH��7KH�UROHV�RI DGPLQLVWUDWLYH�XVHUV�DUH�RI�SDUWLFXODU�LQWHUHVW�LQ�WKH�FRQVWUXFWLRQ�RI�V\V� WHP�VHFXULW\�SROLFLHV��IRU�H[DPSOH��VHFXULW\�DGPLQLVWUDWRU��V\VWHP�RSHUD� WRU���$OPRVW�E\�GHILQLWLRQ��WKH�FRUUHVSRQGLQJ�UROH�VXSSRUW�SURJUDPV�KDYH VHFXULW\�SURSHUWLHV�WKDW�DUH�XQDFFHSWDEOH�ZLWKRXW�VSHFLDO�FRQVWUDLQWV�RQ WKH�EHKDYLRU�RI�DGPLQLVWUDWLYH�XVHUV� 8VHU� LQWHUDFWLRQV� ZLWK� WKH� V\VWHP� PD\� EH� PRGHOHG� LQ� WHUPV� RI� FRQ�

VWUDLQWV�RQ�,�2�GHYLFHV�LI�WKHUH�LV�D�FRQYHQWLRQ�IRU�GLVFXVVLQJ�WKH�FXUUHQW XVHU�RI�D�GHYLFH��([WHUQDO�SROLF\�RQ�XVH�RI�WKH�V\VWHP�QRUPDOO\�UHTXLUHV WKDW� GHYLFHV� SDVV� LQIRUPDWLRQ� RQO\� WR� DXWKRUL]HG� XVHUV�� $Q� DGGLWLRQDO UHDVRQ� IRU� LQWHUHVW� LQ� ,�2� GHYLFHV� LV� WKDW� ,�2� W\SLFDOO\� DFFRXQWV� IRU� D ODUJH�IUDFWLRQ�RI�WKH�7&%��LQ�IDFW��XSZDUGV�RI����SHUFHQW�RI�DQ�HQWLUH�RS� HUDWLQJ�V\VWHP�>7$1(����3UHIDFH@���)URP�WKH�DEVWUDFW�SHUVSHFWLYH�RI�D�VH� FXULW\� PRGHO�� ,�2� GHYLFHV� DUH� HQFDSVXODWHG� E\� 7&%� VRIWZDUH� DQG� DUH W\SLFDOO\�VHHQ�DV�SDVVLYH�HQWLWLHV��,Q�WKH�7&6(&��GHYLFHV�PD\� WUDQVSRUW HLWKHU�XQODEHOHG�GDWD�RU�ODEHOHG�GDWD�DQG�DUH�FODVVLILHG�DV�VLQJOH�OHYHO�RU PXOWLOHYHO�GHYLFHV�DFFRUGLQJO\��$�VLJQLILFDQW�DVSHFW�RI�PXOWLOHYHO�GHYLFHV�LV WKDW�WKH\�DUH�QRW�QRUPDOO\�DVVRFLDWHG�ZLWK�D�VLQJOH�VHFXULW\�OHYHO��WKXV� WKH\�GR�QRW�DFW�OLNH�VWRUDJH�REMHFWV� $V� DOUHDG\� LQGLFDWHG�� VHFXULW\� DWWULEXWHV� PD\� EH� H[SOLFLWO\� DVVRFLDWHG

ZLWK�H[SOLFLWO\�FRQWUROOHG�HQWLWLHV�VXFK�DV�GDWD�VWUXFWXUHV��SURFHVVHV��DQG GHYLFHV�� $GGLWLRQDOO\�� WKHUH� PD\� EH� VHFXULW\�UHOHYDQW� DWWULEXWHV� RI� WKH V\VWHP� HQYLURQPHQW� VXFK� DV� WLPH� RI� GD\�� GD\� RI� ZHHN�� RU� ZKHWKHU� WKH V\VWHP�RU�LWV�HQYLURQPHQW�LV�LQ�D�VWDWH�RI�HPHUJHQF\�

7D[RQRP\�RI�VHFXULW\�PRGHOV�DQG�DWWULEXWHV��3ULPDU\�DVSHFWV�RI�VH� FXULW\�SROLFLHV�WKDW�DUH�XVHIXOO\�UHIOHFWHG�LQ�WKH�VHFXULW\�PRGHO�LQFOXGH�WKH SROLF\�REMHFWLYH�� ORFXV� RI� SROLF\� HQIRUFHPHQW�� VWUHQJWK� RI� SROLF\� HQIRUFH� PHQW�� JUDQXODULW\� RI� XVHU� GHVLJQDWLRQV�� DQG� ORFXV� RI� DGPLQLVWUDWLYH DXWKRULW\��7KHVH�SROLF\�DVSHFWV�DUH�QRUPDOO\�UHIOHFWHG�LQ�WKH�VHFXULW\�DW� WULEXWHV�RI�FRQWUROOHG�HQWLWLHV�ZKHQ�WKH�SROLFLHV�DUH�IRUPDOL]HG��6HFXULW\ DWWULEXWHV�PD\�EH�LPSOLFLW��WKH\�QHHG�QRW�EH�GLUHFWO\�LPSOHPHQWHG�LQ�GDWD VWUXFWXUHV� $,6�VHFXULW\�REMHFWLYHV�DUH�WUDGLWLRQDOO\�FODVVLILHG�DV�QRQGLVFORVXUH��LQ�

WHJULW\�� RU� DYDLODELOLW\� REMHFWLYHV� >1&6&��D@�� $� GUDIW� &DQDGLDQ� VWDQGDUG KDV� DGGHG� DFFRXQWDELOLW\� DV� D� IRXUWK�� VXSSRUWLQJ� REMHFWLYH� >&66&��@� 1RQGLVFORVXUH�REMHFWLYHV�JXDUG�DJDLQVW�LQDSSURSULDWH�GLVFORVXUH�RI�LQIRU� PDWLRQ�� $VVRFLDWHG� V\VWHP� SROLFLHV� DQG� DWWULEXWHV� DUH� XVHG� WR� SUHYHQW XQDXWKRUL]HG�UHOHDVH�RI�LQIRUPDWLRQ��7KHUH�DUH�WZR�SULQFLSDO�NLQGV�RI�LQ� WHJULW\� REMHFWLYHV�� 6RXUFH�LQWHJULW\� REMHFWLYHV� SURPRWH� WKH� FRUUHFWQHVV� RU DSSURSULDWHQHVV�RI�LQIRUPDWLRQ�VRXUFHV��$VVRFLDWHG�V\VWHP�SROLFLHV�JXDUG DJDLQVW� XQDXWKRUL]HG� FUHDWLRQ� RU� PRGLILFDWLRQ� RI� LQIRUPDWLRQ�� &RQWHQW� FRUUHFWQHVV� REMHFWLYHV� SURPRWH� FRUUHFWQHVV� RI� LQIRUPDWLRQ�� $VVRFLDWHG V\VWHP�SROLFLHV�DQG�DWWULEXWHV�QRW�RQO\�JXDUG�DJDLQVW�XQDXWKRUL]HG�FUHD�

)RUPDO�0HWKRGV�DQG�0RGHOV ���

WLRQ�DQG�PRGLILFDWLRQ�RI�LQIRUPDWLRQ�EXW�DOVR�DFWLYHO\�DVVLVW�LQ�FKHFNLQJ FRUUHFWQHVV�RI�LQSXW�DQG�LQ�HQVXULQJ�FRUUHFWQHVV�DQG�DSSURSULDWHQHVV�RI VRIWZDUH�XVHG�IRU�SURFHVVLQJ��$YDLODELOLW\�SURPRWHV�WKH�DYDLODELOLW\�RI�LQ� IRUPDWLRQ�LQ�D�WLPHO\��XVHIXO�IDVKLRQ��5HODWLYHO\�OLWWOH�ZRUN�KDV�EHHQ�GRQH ZLWK�DYDLODELOLW\�SROLFLHV�SHU�VH��$YDLODELOLW\�LV�D�EURDG�WRSLF�WKDW�LQFOXGHV IDXOW�WROHUDQFH�DV�ZHOO�DV�WKH�SUHYHQWLRQ�RI�IDLOXUHV�WKDW�FDQ�UHVXOW�IURP GHQLDO�RI�VHUYLFH� DWWDFNV�� VRIWZDUH� HUURUV�� DQG�RU� GHVLJQ� RYHUVLJKWV�� )L� QDOO\��DFFRXQWDELOLW\�SURPRWHV�DZDUHQHVV�RI�XVHU�DFWLRQV��$VVRFLDWHG�DF� FRXQWDELOLW\� SROLFLHV� LQYROYH� WKH� FROOHFWLRQ�� DQDO\VLV�� DQG� XVH� RI� DXGLW GDWD��7KHUH�KDYH�EHHQ�DOPRVW�QR�IRUPDO�PRGHOV�RI�DFFRXQWDELOLW\�SROLFLHV� ,QIRUPDWLRQDO�SROLFLHV�PDLQWDLQ�VHFXULW\�DWWULEXWHV�IRU�XVH�E\�WKH�V\VWHP

DQG�LWV�XVHUV��ZKHUHDV�DFFHVV�FRQWURO�SROLFLHV�DQG�DWWULEXWHV�OLPLW�DFFHVV WR� V\VWHP� UHVRXUFHV� DQG� WKH� LQIRUPDWLRQ� WKH\� FRQWDLQ�� $FFHVV� FRQWURO SROLFLHV�DUH�RIWHQ�GHVFULEHG�LQ�WHUPV�RI�DFFHVVHV�E\�VXEMHFWV�RU�RWKHU�DF� WLYH�HQWLWLHV�WR�REMHFWV�RU�RWKHU�SDVVLYH�HQWLWLHV��$FFHVV�FRQWURO�LV�HQIRUFHG E\�WKH�UHIHUHQFH�PRQLWRU�SRUWLRQ�RI�WKH�7&%��$W�ORZHU�OHYHOV�RI�DEVWUDFWLRQ� WKH�UHIHUHQFH�PRQLWRU�LV�UHIHUUHG�WR�DV�WKH�7&%�NHUQHO� $FFHVV�FRQWURO�DWWULEXWHV�PD\�EH�FODVVLILHG�DFFRUGLQJ�WR�ZKDW�WKH\�FRQ�

WURO�� $� ORRVH� DWWULEXWH� LV� DVVRFLDWHG� ZLWK� D� FRQWUROOHG� HQWLW\�� ZKHUHDV� D WLJKW� DWWULEXWH� LV� DVVRFLDWHG� ZLWK� ERWK� WKH� HQWLW\� DQG� WKH� LQIRUPDWLRQ� LW FRQWDLQV�� $FFHVV� UHVWULFWLRQV� GHWHUPLQHG� E\� WLJKW� DFFHVV� FRQWURO� DWWULE� XWHV�PXVW�SURSDJDWH�IURP�RQH�REMHFW�WR�DQRWKHU�ZKHQ��RU�EHIRUH��LQIRU� PDWLRQ�LV�WUDQVIHUUHG��EHFDXVH�FRQWURO�RYHU�WKH�LQIRUPDWLRQ�PXVW�VWLOO�EH PDLQWDLQHG� DIWHU� LW� LV� WUDQVIHUUHG�� 7KH� XVHU� JUDQXODULW\� RI� DQ� DWWULEXWH PD\� EH� ´FRDUVH�µ� FRQWUROOLQJ� DFFHVV� RQ� WKH� EDVLV� RI� EURDGO\� GHILQHG FODVVHV�RI�XVHUV��RU�LW�PD\�EH�´SHU�XVHU�µ�FRQWUROOLQJ�DFFHVV�E\�LQGLYLGXDO XVHUV�DQG�SURFHVVHV�DFWLQJ�RQ�WKHLU�EHKDOI��)LQDOO\��FHQWUDOL]HG�DXWKRULW\ LPSOLHV�WKDW�SROLF\�IRU�XVH�RI�DWWULEXWHV�LV�SUHGHILQHG�DQG�WDNHV�SODFH�XQ� GHU� WKH� FRQWURO� RI� D� V\VWHP� VHFXULW\� DGPLQLVWUDWRU�� ZKHUHDV� GLVWULEXWHG DXWKRULW\�LPSOLHV�WKDW�DWWULEXWHV�DUH�VHW�E\�LQGLYLGXDO�XVHUV�IRU� HQWLWLHV XQGHU�WKHLU�FRQWURO��0RVW�VHFXULW\�SROLFLHV�XVH�D�PL[�RI�FHQWUDOL]HG�DQG GLVWULEXWHG�DXWKRULW\� $�VHFXULW\�DWWULEXWH�EHORQJLQJ�WR�D�SDUWLDOO\�RUGHUHG�VHW�PD\�EH�UHIHUUHG

WR�DV�D�OHYHO��7KH�XVH�RI�SDUWLDOO\�RUGHUHG�OHYHOV�LV�XVXDOO\�DVVRFLDWHG�ZLWK WLJKW� DFFHVV� FRQWURO� SROLFLHV� DQG� FRQVWUDLQWV� RQ� LQIRUPDWLRQ� IORZ�� &RQ� VWUDLQWV�RQ�LQIRUPDWLRQ�IORZ�FDQ�DULVH�IRU�VHYHUDO�GLIIHUHQW�UHDVRQV��$V�D UHVXOW�� D� PXOWLIDFHWHG� SROLF\� PLJKW� DVVRFLDWH� ERWK� LQWHJULW\� OHYHOV� DQG QRQGLVFORVXUH�OHYHOV�ZLWK�FRQWUROOHG�HQWLWLHV�WR�VXSSRUW�ERWK�NLQGV�RI�RE� MHFWLYHV��:LWKLQ�D�FRPSXWLQJ�V\VWHP��WKH�EHKDYLRU�RI�QRQGLVFORVXUH�OHYHOV QRUPDOO\�GHSHQGV�RQO\�RQ�WKH�DEVWUDFW�SURSHUWLHV�RI�WKH�SDUWLDO�RUGHULQJ� UDWKHU�WKDQ�RQ�GHWDLOV�RI�WKH�LQWHUQDO�VWUXFWXUH�RI�WKH�OHYHOV��IRU�H[DPSOH� KLHUDUFKLFDO�FODVVLILFDWLRQV�DQG�FDWHJRU\�VHWV���7KLV�IDFW�FDQ�EH�H[SORLWHG WR�HQODUJH�WKH�FODVV�RI�SROLFLHV�WKDW�D�JLYHQ�V\VWHP�FDQ�HQIRUFH�>%(//��@�

��� ,QIRUPDWLRQ�6HFXULW\

([DPSOH�GHILQLWLRQV�RI�VHFXULW\��0DQ\�LI�QRW�PRVW�VHFXULW\�PRGHOV�DUH GHWHUPLQLVWLF�VWDWH�PDFKLQH�PRGHOV�WKDW�IRUPDOL]H�DFFHVVHV�RI�VXEMHFWV�WR REMHFWV� DQG� DUH� GHVFHQGDQWV� RI� /DPSVRQ·V� DFFHVV�PDWUL[� PRGHO >/$03��@��,Q�/DPSVRQ·V�PRGHO��REMHFWV�DUH�YLHZHG�DV�VWRUDJH�FRQWDLQHUV� WKH� DFFHVV� FRQWURO� FKHFNV� GR� QRW� GHSHQG� RQ� WKH� YDOXHV� VWRUHG� LQ� WKHVH FRQWDLQHUV��6HFXULW\�FULWLFDO�DVSHFWV�RI�WKH�V\VWHP�VWDWH�DUH�VXPPDUL]HG LQ� DQ� DFFHVV� PDWUL[� VXFK� DV� WKH� RQH� LQ� )LJXUH� ��� ,Q� DGGLWLRQ� WR� VWDWH� PDFKLQH�PRGHOV��RWKHU�PRGHOV�RI�FRPSXWDWLRQ�KDYH�EHHQ�XVHG�VXFFHVV� IXOO\�LQ�IRUPDO�GHILQLWLRQV�RI�VHFXULW\��0RVW�RI�WKHVH�DUH�H[WHUQDO�LQWHUIDFH PRGHOV�EDVHG�RQ�HYHQW�KLVWRULHV��7KH�ZRUN�RI�$QGUHZ�0RRUH�LV�D�JRRG�H[� DPSOH�>0225��@�

2EMHFWV

6XEMHFWV 2 �

2 �

2 �

������6 �

5HDG�([HFXWH

������6 �

:ULWH

������6 �

([HFXWH 5HDG

Figure 2. An access matrix.

7KH�IROORZLQJ�SDUDJUDSKV�GLVFXVV�WKUHH�FODVVHV�RI�VHFXULW\�PRGHOV�WKDW KDYH� DULVHQ� LQ� WKH� OLWHUDWXUH�� ZLWK� HPSKDVLV� RQ� WKH� WD[RQRPLF� IHDWXUHV PHQWLRQHG�DERYH��$OO�RI�WKHVH�H[DPSOHV�H[WHQG�/DPSVRQ·V�DFFHVV�PDWUL[ PRGHO�E\�DVVLJQLQJ�VHFXULW\�DWWULEXWHV�WR�REMHFWV�DQG�DGGLQJ�GHILQLWLRQV RI�VHFXULW\�WKDW�FRQVWUDLQ�WKH�SRVVLEOH�IRUPV�WKDW�WKH�DFFHVV�PDWUL[�FDQ WDNH�

7UDGLWLRQDO�PDQGDWRU\�DFFHVV�FRQWURO��0$&�

� 2EMHFWLYH��1RQGLVFORVXUH � /RFXV�RI�XVH��,QWHUQDO�DQG�H[WHUQDO�DFFHVV�FRQWURO � %LQGLQJ�VWUHQJWK��7LJKW � 8VHU�JUDQXODULW\��&RDUVH � $XWKRULW\��&HQWUDOL]HG

0$&�SROLFLHV�WKDW�PHHW�7&6(&�UHTXLUHPHQWV� PXVW� HQIRUFH� QRQGLVFOR� VXUH�FRQVWUDLQWV�RQ�LQIRUPDWLRQ�DQG�PD\�HQIRUFH�LQWHJULW\�FRQVWUDLQWV�DV ZHOO�� )RU� V\VWHPV� HYDOXDWHG� DW� %�� DQG� DERYH�� WKHUH� DUH� FRYHUW� FKDQQHO DQDO\VLV�UHTXLUHPHQWV�ZKLFK�LPSO\�WKDW�WKH�FRQWUROV�DUH�WLJKW��FRQWUROOLQJ DFFHVV� WR� LQIRUPDWLRQ� DV� ZHOO� DV� WR� LQGLYLGXDO� REMHFWV� DQG� VXEMHFWV�� $O� WKRXJK�WKH�7&6(&�HPSKDVL]HV�ODEHOLQJ�UHTXLUHPHQWV�DW�WKH� XVHU� LQWHU� IDFH�� WKLV� DVSHFW� RI� 0$&� KDV� QRW� UHFHLYHG� PXFK� IRUPDO� DWWHQWLRQ�� 0$&

)RUPDO�0HWKRGV�DQG�0RGHOV ���

SROLF\�LGHQWLILHV�XVHUV�RQO\�LQ�WHUPV�RI�WKHLU�DVVRFLDWHG�PD[LPXP�QRQGLV� FORVXUH� OHYHOV�� &RQVHTXHQWO\�� SHU�XVHU� JUDQXODULW\� LV� QRW� DFKLHYHG� EH� FDXVH�LQIRUPDWLRQ�DYDLODEOH�WR�D�XVHU�DW�D�JLYHQ�OHYHO�LV�DOVR�DYDLODEOH�WR RWKHU�XVHUV�DW�WKDW�RU�KLJKHU�OHYHOV��,Q�PRVW�V\VWHPV��PRVW�XVHUV�DUH�QRW DXWKRUL]HG� WR� DOWHU� DQ� REMHFW·V� QRQGLVFORVXUH� OHYHO� EHFDXVH� GHFLVLRQV DERXW�DYDLODELOLW\�RI�FODVVLILHG�LQIRUPDWLRQ�DUH�XQGHU�FHQWUDOL]HG�FRQWURO� $�YDULHW\�RI�H[WHUQDO�LQWHUIDFH�PRGHOV�KDYH�EHHQ�JLYHQ�IRU�WKH�QRQGLV�

FORVXUH�REMHFWLYH��EXW�QRW�DOO�VXFFHHG�LQ�SURYLGLQJ�WLJKW�FRQWUROV�RQ�DFFHVV WR�LQIRUPDWLRQ��1RQLQWHUIHUHQFH�LV�WLJKW�LQ�WKH�FDVH�RI�GHWHUPLQLVWLF�V\V� WHPV�>*2*8����*2*8��@��%XW�WKH�PRGHOLQJ�SUREOHP�LV�PRUH�GLIILFXOW�IRU QRQGHWHUPLQLVWLF� V\VWHPV� ZKRVH� EHKDYLRU� LV� QRW� HQWLUHO\� SUHGLFWDEOH� RQ WKH� EDVLV� RI� V\VWHP� LQSXWV� >:,77���� *5$<��@�� ,QWHUQDO� UHTXLUHPHQWV PRGHOV�DUH�PRUH�FRPPRQ�WKDQ�H[WHUQDO�LQWHUIDFH�PRGHOV��WKH\�DUH�´VXE� MHFW�SRLQW�RI�YLHZµ� PRGHOV� WKDW� GHVFULEH� FRQVWUDLQWV� RQ� WKH� EHKDYLRU� RI LQGLYLGXDO� VXEMHFW� LQVWUXFWLRQV�� 7KH� EHVW� NQRZQ� RI� WKHVH� LQWHUQDO� FRQ� VWUDLQWV�DUH�WKH�VLPSOH�VHFXULW\�SURSHUW\��D�VXEMHFW�PD\�UHDG�RQO\�DW�RU EHORZ�LWV�OHYHO��DQG�WKH� �SURSHUW\��D�VXEMHFW�PD\�ZULWH�RQO\�DW�RU�DERYH LWV�OHYHO���%XW�DGGLWLRQDO�FRQVWUDLQWV�RQ�VXEMHFW� LQVWUXFWLRQV� DUH� QHHGHG IRU� WLJKW� SROLF\� HQIRUFHPHQW�� DV� DUH� FRQVWUDLQWV� RQ� WKH� VFKHGXOLQJ� RI VXEMHFWV�>:,//��@� $Q�LQWHUHVWLQJ�YDULDQW�RI�WUDGLWLRQDO�0$&�LV�IRXQG�LQ�WKH�IORDWLQJ�ODEHO

SROLF\� RI� WKH� &RPSDUWPHQWHG�0RGH� :RUNVWDWLRQ� �&0:�� >:22'��� 0,//��@��(DFK�ILOH�KDV�D�IORDWLQJ�´LQIRUPDWLRQµ�ODEHO�DQG�D�IL[HG�´VHQVL� WLYLW\µ�ODEHO�WKDW�GRPLQDWHV�WKH�IORDWLQJ�ODEHO��7KH�IORDWLQJ�ODEHO�LV�D�SR� WHQWLDOO\� PRUH� DFFXUDWH� ODEHO� WKDW� LQIRUPV� WKH� XVHU� EXW� LV� QRW� XVHG LQWHUQDOO\�IRU�DFFHVV�FRQWURO��$V�LPSOHPHQWHG�LQ�WKH�&0:��WKH�IORDWLQJ� ODEHO� PHFKDQLVP� LV� QRW� WLJKWO\� DVVRFLDWHG� ZLWK� LQIRUPDWLRQ� EHFDXVH� RI VRPH�XQUHVROYHG�FRYHUW�FKDQQHO�LVVXHV� 0RVW�0$&�PRGHOV�UHTXLUH�D�VXEMHFW�WKDW�GRHV�QRW�EHORQJ�WR�WKH�7&%�WR

KDYH�D�OHYHO�WKDW�GRPLQDWHV�WKH�OHYHOV�RI�LWV�SUHYLRXV�LQSXWV�DQG�LV�GRPL� QDWHG�E\�WKRVH�RI�LWV�IXWXUH�RXWSXWV��7KLV�UHTXLUHPHQW�IDLOV�WR�DGGUHVV�WKH SRVVLELOLW\� WKDW� D� VXEMHFW� PD\� EH� DEOH� WR� SURGXFH� LQIRUPDWLRQ� ZKLFK� LV PRUH�KLJKO\�FODVVLILHG�WKDQ�LWV�LQSXWV�WKURXJK�VRPH�IRUP�RI�DJJUHJDWLRQ RU�LQIHUHQFH��'HILQLWLRQV�RI�VHFXULW\�WKDW�DFFRPPRGDWH�DJJUHJDWLRQ�KDYH EHHQ� JLYHQ� LQ� WKH� 6006� PRGHO� >/$1'��@� DQG� LQ� WKH� ZRUN� RI� 0HDGRZV >0($'��D@�� )RUPDO� WUHDWPHQWV� RI� WKH� LQIHUHQFH� SUREOHP� DUH� DOVR� DYDLO� DEOH�>+$,*����'(11����&K���@�

7UDGLWLRQDO�GLVFUHWLRQDU\�DFFHVV�FRQWURO��'$&�

� 2EMHFWLYH��1RQGLVFORVXUH�DQG�LQWHJULW\ � /RFXV�RI�XVH��,QWHUQDO�DFFHVV�FRQWURO � %LQGLQJ�VWUHQJWK��/RRVH � 8VHU�JUDQXODULW\��3HU�XVHU � $XWKRULW\��'LVWULEXWHG

��� ,QIRUPDWLRQ�6HFXULW\

7KH� REMHFWLYHV� EHKLQG� '$&� PHFKDQLVPV� DUH� JHQHUDOO\� DVVXPHG� WR� EH XVHU�GHSHQGHQW� DQG� KDYH� QRW� EHHQ� ZHOO� DUWLFXODWHG�� IRU� WKH� PRVW� SDUW� 7\SLFDOO\��XVHUV�DUH�QRW�DXWRPDWLFDOO\�LQIRUPHG�ZKHQ�WKH\�SULQW�RXW�DQ REMHFW�ZKRVH�DFFHVV�LV�OLPLWHG�E\�DQRWKHU�RZQHU�RU��IRU�WKDW�PDWWHU��ZKHQ WKH\�FRS\�LW�WR�DQRWKHU�OHVV�SURWHFWHG�REMHFW��$XWKRULW\�WR�FKDQJH�GLVFUH� WLRQDU\�DWWULEXWHV�LV�XVXDOO\�GLVWULEXWHG�DPRQJ�DOO�XVHUV�RQ�WKH�EDVLV�RI RZQHUVKLS�� EXW� WKLV� LV� QRW� D� 7&6(&� UHTXLUHPHQW�� 7KH� SULPDU\� GLVWLQ� JXLVKLQJ�FKDUDFWHULVWLF�RI�WKH�7&6(&�'$&�UHTXLUHPHQWV�LV�WKH�DELOLW\�WR FRQWURO�DFFHVV�RQ�D�SHU�XVHU�EDVLV� %HOO�DQG�/D3DGXOD�OLVWHG�RQO\�RQH�LQWHUQDO�UHTXLUHPHQW�IRU�GLVFUHWLRQDU\

DFFHVV�� ,Q� HDFK� VWDWH�� DFFHVV� WR� DQ� REMHFW� LPSOLHG� SHUPLVVLRQ� WR� DFFHVV WKH�LQIRUPDWLRQ�FRQWDLQHG�LQ�WKDW�REMHFW�>%(//��@��7KLV�DQG�RWKHU�LQWHU� QDO�UHTXLUHPHQWV�RI�WKHLU�PRGHO�ZHUH�SKUDVHG�DV�VWDWH�LQYDULDQWV��SURSHU� WLHV�WKDW�PXVW�KROG�LQ�HYHU\�´VHFXUHµ�VWDWH�RI�WKH�V\VWHP��8QIRUWXQDWHO\� WKHLU� GLVFUHWLRQDU\� FRQVWUDLQW� LV� QRW� DFWXDOO\� VDWLVILHG� LQ� 8QL[�OLNH� V\V� WHPV�EHFDXVH�WKH�IROORZLQJ�FDQ�KDSSHQ��7KH�RZQHU�RI�D�ILOH�DOORZV�DFFHVV WR�DQRWKHU�XVHU��D�SURFHVV�DFWLQJ�RQ�EHKDOI�RI�WKH�RWKHU�XVHU�RSHQV�WKH ILOH�� WKH� RZQHU� UHYRNHV� DFFHVV�� WKH� SURFHVV� FRQWLQXHV� WR� DFFHVV� WKH� ILOH XQWLO� LW� WHUPLQDWHV�� ,Q� 8QL[�OLNH� V\VWHPV�� WKH� GLVFUHWLRQDU\� DFFHVV� FRQ� VWUDLQW�>%(//��@�QHHGV�WR�EH�ZHDNHQHG�WR�D�VWDWH�WUDQVLWLRQ�FRQVWUDLQW��,I D�SURFHVV�GRHV�QRW�KDYH�D�SDUWLFXODU�NLQG�RI�DFFHVV�WR�D�ILOH�LQ�RQH�VWDWH EXW� GRHV� LQ� WKH� QH[W� VWDWH�� WKHQ� LW� PXVW� KDYH� KDG� WKH� QHFHVVDU\� '$& SHUPLVVLRQV� LQ� WKH� SUHFHGLQJ� VWDWH�� 7KH� WUDGLWLRQDO� ZHDNQHVVHV� DVVRFL� DWHG�ZLWK�'$&�DUH�QRW�LQKHUHQW��0HWKRGV�IRU�HIILFLHQW�UHYRFDWLRQ�RI�DFFHVV KDYH�DOVR�EHHQ�GHYLVHG�>.$5*��@��0RUHRYHU��WLJKW�DFFHVV�FRQWURO�PHFKD� QLVPV� ZLWK� SHU�XVHU� JUDQXODULW\� DQG� GLVWULEXWHG� FRQWURO� KDYH� EHHQ� GH� VFULEHG�DQG�PRGHOHG�E\�0LOOHQ�DQG�RWKHUV�>0,//����,65$����*5$8��D� 0&&2��@�

,QWHJULW\�j�OD�&ODUN�DQG�:LOVRQ

� 2EMHFWLYH��,QWHJULW\ � /RFXV�RI�XVH��([WHUQDO�DQG�LQWHUQDO�FRQVLVWHQF\ � %LQGLQJ�VWUHQJWK��/RRVH � 8VHU�JUDQXODULW\��3HU�XVHU�DQG�SHU�SURFHGXUH � $XWKRULW\��&HQWUDOL]HG

7KH� DQQRXQFHG� REMHFWLYH� RI� &ODUN� DQG� :LOVRQ·V� PRGHO� >&/$5��@� LV� WR ´HQVXUH�LQWHJULW\�RI�GDWD�WR�SUHYHQW�IUDXG�DQG�HUURUV�µ�7KLV�REMHFWLYH�LP� SOLHV� VRPH� IRUP� RI� ´H[WHUQDOµ� FRQVLVWHQF\� EHWZHHQ� GDWD� DQG� UHDO�ZRUOG VLWXDWLRQV�WKDW�WKH�GDWD�UHIHUV�WR��([WHUQDO�FRQVLVWHQF\��LQ�WXUQ��LPSRVHV UHFRJQL]DEOH�VWUXFWXUH�RQ�GDWD��D�IRUP�RI�´LQWHUQDOµ�FRQVLVWHQF\�WKDW�FDQ EH�DXWRPDWLFDOO\�FKHFNHG��,QWHJULW\�LV�VXSSRUWHG�WKURXJK�YDULRXV�IRUPV�RI H[WHUQDO�DQG�LQWHUQDO�UHGXQGDQF\��6HSDUDWLRQ�RI�GXW\�HQVXUHV�WKDW�WZR�RU PRUH� XVHUV� ZLOO� LQGHSHQGHQWO\� EH� LQYROYHG� LQ� NH\� IDFWV� NQRZQ� WR� WKH

)RUPDO�0HWKRGV�DQG�0RGHOV ���

FRPSXWHU��DQG�LQWHJULW\�YDOLGDWLRQ�SURFHGXUHV�FKHFN�WKH�H[SHFWHG�LQWHUQDO VWUXFWXUH� RI� GDWD� REMHFWV�� $FFHVV� FRQWURO� LQ� WKH� &ODUN�:LOVRQ� PRGHO� LV EDVHG�RQ�D�VHW�RI�WULSOHV�RI�WKH�IRUP��XVHU��SURJUDP��REMHFW�OLVW��XVHG�WR FRQWURO�KRZ�DQG�ZKHWKHU�HDFK�XVHU�PD\�DFFHVV�D�JLYHQ�FROOHFWLRQ�RI�RE� MHFWV��0DQXDO�PHWKRGV�DUH�XVHG�WR�HQVXUH�WKDW�WKH�WULSOHV�DGHTXDWHO\�UH� VWULFW� XVHU� UROHV� DQG� HQIRUFH� VHSDUDWLRQ� RI� GXW\�� &ODUN� DQG� :LOVRQ·V RULJLQDO�PRGHO�ZDV�LQIRUPDO�LQ�WKH�VHQVH�RI�WKLV�HVVD\��7KHLU�DFFHVV�FRQ� WURO� PHFKDQLVPV� KDYH� VLQFH� EHHQ� IRUPDOO\� PRGHOHG� LQ� WKH� FRQWH[W� RI� D 8QL[�EDVHG�LPSOHPHQWDWLRQ�>/$3$��@��%XW�QR�IRUPDO�GHILQLWLRQ�RI�VHFXULW\ LV�DYDLODEOH�IRU�WKHLU�ZRUN��DQG�LW� LV� SRVVLEOH� WKDW� WKHLU� PHFKDQLVPV� GR QRW�IXOO\�DGGUHVV�WKHLU�REMHFWLYHV�>0,//��@� $QRWKHU� DFFHVV� FRQWURO� PHFKDQLVP� WKDW� KDV� EHHQ� XVHG� WR� FRQVWUDLQ

XVHU�UROHV�LV�W\SH�HQIRUFHPHQW�>%2(%��@��7KH�W\SH�HQIRUFHPHQW�PHFKD� QLVP�LWVHOI�DVVLJQV�´W\SHVµ�WR�ERWK�VXEMHFWV�DQG�REMHFWV��6XEMHFW�W\SHV�DUH UHIHUUHG� WR� DV� ´GRPDLQV�µ� DQG� WKH� DFFHVVHV� RI� HDFK� VXEMHFW� DUH� FRQ� VWUDLQHG�E\�D�´W\SH� WDEOHµ� EDVHG� RQ� VXEMHFW� GRPDLQ� DQG� REMHFW� W\SH�� ,Q WKH�lock W\SH�HQIRUFHPHQW�PHFKDQLVP��HDFK�XVHU�KDV�DQ�DVVRFLDWHG�VHW�RI GRPDLQV�WKDW� VXEMHFWV� UXQQLQJ� RQ� KLV� EHKDOI� PD\� EHORQJ� WR�� DQG� WKHVH GRPDLQV�DUH�XVHG�WR�GHILQH�XVHU�UROHV�>7+20��D@��,Q�WKLV�ZD\��WKH� lock DFFHVV� FRQWURO� PHFKDQLVPV� FDQ� DOVR� HQIRUFH� WKUHH�ZD\� FRQVWUDLQWV DPRQJ�XVHUV��VXEMHFWV��DQG�REMHFWV��Lock W\SH�HQIRUFHPHQW�ODFNV�SHU�XVHU JUDQXODULW\��EXW�WKLV�PD\�EH�DQ�DGYDQWDJH��LI�UROH�GHILQLWLRQV�FKDQJH�OHVV IUHTXHQWO\�WKDQ�XVHUV��6HSDUDWLRQ�RI�GXW\�LWVHOI�KDV�DOVR�WXUQHG�XS�LQ�UROH GHILQLWLRQV�IRU�DGPLQLVWUDWLYH�XVHUV��,QVWUXFWLYH�H[DPSOHV�LQFOXGH�WKH�6H� FXUH� 0LOLWDU\� 0HVVDJH� 6\VWHP� PRGHO� >/$1'��@� DQG� WKH� DGPLQLVWUDWLYH UROHV� IRU� 6HFXUH� ;HQL[� >*/,*��@�� ZKLFK� LV� QRZ� UHIHUUHG� WR� DV� 7UXVWHG ;HQL[�

,VVXHV�LQ�WKH�XVH�RI�IRUPDO�PHWKRGV

-XVW� KRZ� ´IRUPDOµ� VKRXOG� IRUPDO� PHWKRGV� EH"� :KDW� DUH� WKH� UHTXLUH� PHQWV�IRU�WKHLU�XVH�DQG�ZKDW�VKRXOG�WKH\�EH"�,V�FRVW�HIIHFWLYH�XVH�IHDVL� EOH�ZLWKLQ�WKH�FXUUHQW�VWDWH�RI�WKH�DUW"�7KH�IROORZLQJ�SDUDJUDSKV�SDUWLDOO\ DQVZHU�WKHVH�TXHVWLRQV�

0DWKHPDWLFDO�ULJRU�DQG�IRUPDO�ORJLFDO�V\VWHPV��7KHUH�DUH�WKUHH�GLI� IHUHQW�FRPPRQ�QRWLRQV�RI�´IRUPDO�SURRIµ�WKDW�PLJKW�EH�XVHG�ZLWK�IRUPDO PHWKRGV� �DQG� WKXV� WKUHH� VRPHZKDW� GLIIHUHQW� QRWLRQV� RI� ZKDW� IRUPDO PHWKRGV�DUH��

�� 0DWKHPDWLFDO� SURRI�� $� IRUPDO� SURRI� LV� D� FRPSOHWH� DQG� FRQYLQFLQJ PDWKHPDWLFDO�DUJXPHQW��SUHVHQWLQJ�WKH�IXOO�ORJLFDO�MXVWLILFDWLRQ�IRU HDFK� SURRI� VWHS�� IRU� WKH� WUXWK� RI� D� WKHRUHP� RU� VHW� RI� WKHRUHPV >1&6&��@�

��� ,QIRUPDWLRQ�6HFXULW\

�� 0DFKLQH�FKHFNHG� SURRI�� $� IRUPDO� SURRI� LV� HYLGHQFH� DFFHSWHG� E\� D SURRI�FKHFNHU�VKRZLQJ�WKDW�D�FRQMHFWXUH�LV�D�YDOLG�FRQVHTXHQFH�RI JLYHQ�D[LRPV�

�� +LOEHUW�SURRI��$�IRUPDO�SURRI�LQ�D�WKHRU\�7�LV�D�VHTXHQFH�RI�IRUPX� ODV��HDFK�RI�ZKLFK�LV�HLWKHU�DQ�D[LRP�RI�7�RU�D�GLUHFW�FRQVHTXHQFH RI�SUHFHGLQJ�IRUPXODV�LQ�WKH�VHTXHQFH�E\�YLUWXH�RI�D�UXOH�RI�LQIHU� HQFH�DVVRFLDWHG�ZLWK�WKH�XQGHUO\LQJ�IRUPDO�V\VWHP�>0(1'��@�

0DWKHPDWLFDO�SURRIV�GHSHQG�RQ�WKH�XVH�RI�PDWKHPDWLFDO�(QJOLVK�IRU�WKH IRUPXODWLRQ�RI�D�PRGHO�RU�VSHFLILFDWLRQ��7KH\�EHQHILW�IURP�WKH�EDVLF�IOH[L� ELOLW\�RI�(QJOLVK��EXW�WKH\�GR�QRW�DOORZ�IRU�DXWRPDWHG�DVVLVWDQFH��,QDFFX� UDFLHV� FDQ� UHVXOW� IURP� WKH� IDFW� WKDW� WKHUH� LV� QR� SUHFLVH� GHILQLWLRQ� RI PDWKHPDWLFDO�(QJOLVK��,Q�PRVW�FRQWH[WV�RWKHU�WKDQ�WKH�7&6(&��PDWKH� PDWLFDO�SURRIV�DUH�UHJDUGHG�DV�ULJRURXV�EXW�QRW�IRUPDO�³�PHDQLQJ�WKDW WKH\�FRQIRUP�WR�FRPPRQO\�DFFHSWHG�VWDQGDUGV�RI�PDWKHPDWLFDO�UHDVRQ� LQJ�EXW�DUH�QRW�VXSSRUWHG�E\�D�IRUPDO�VHPDQWLFV�LQ�WKH�VHQVH�PHQWLRQHG EHORZ� $� PDFKLQH�FKHFNHG� SURRI� UHOLHV� RQ� WKH� XVH� RI� D� PHFKDQLFDO� SURRI

FKHFNHU��D�WRRO�ZLWK�WKH�IROORZLQJ�SURSHUWLHV�

�� ,W�DFFHSWV�DV�LQSXW�DQ�DVVHUWLRQ��FDOOHG�D�FRQMHFWXUH���D�VHW�RI�DV� VHUWLRQV��FDOOHG�DVVXPSWLRQV���DQG�D�SURRI�

�� ,W�WHUPLQDWHV�DQG�RXWSXWV�HLWKHU�VXFFHVV�RU�IDLOXUH� �� ,I�LW�VXFFHHGV��WKHQ�WKH�FRQMHFWXUH�LV�D�YDOLG�FRQVHTXHQFH�RI�WKH�DV�

VXPSWLRQV�>1&6&��@�

$�SURRI�FKHFNHU�KDV�WKH�SRWHQWLDO�RI�LPSURYLQJ�XVHU�HIILFLHQF\��7KH�QHHG IRU� VXFK� DXWRPDWHG� DVVLVWDQFH� LV� XVXDOO\� DSSDUHQW� LQ� VHFXULW\� SROLF\ PRGHOV�IRU�RSHUDWLQJ�V\VWHPV��7KH�GHILQLWLRQ�RI�VHFXULW\�W\SLFDOO\�FRQWDLQV GR]HQV� RI� UHTXLUHPHQWV�� SRVVLEO\� LQ� WKH� IRUP� RI� VWDWH� LQYDULDQWV� DQG VWDWH�WUDQVLWLRQ�FRQVWUDLQWV��7KHUH�FDQ�HDVLO\�EH�XSZDUGV�RI�WZHQW\�UXOHV RI� RSHUDWLRQ�� HDFK� RI� ZKLFK� PXVW� EH� FRQVLVWHQW� ZLWK� DOO� RI� WKH� UHTXLUH� PHQWV�� DQG� WKLV� DPRXQWV� WR� KXQGUHGV� RI� OHPPDV�� 7\SLFDOO\�� D� UHTXLUH� PHQW�GHDOV�ZLWK�RQO\�D�IHZ�VWDWH�FRPSRQHQWV��DQG�DQ\�UXOH�RI�RSHUDWLRQ WKDW� GRHV� QRW� DOWHU� WKRVH� FRPSRQHQWV� WULYLDOO\� IDLOV� WR� YLRODWH� WKDW� UH� TXLUHPHQW��&RQVHTXHQWO\��DV�PDQ\�DV����SHUFHQW�RI�WKH�QHHGHG�OHPPDV DUH�OLNHO\�WR�EH�HVVHQWLDOO\�WULYLDO� $�PHFKDQLFDO�SURRI�FKHFNHU�LV�XQOLNHO\�WR�DFKLHYH�D�KLJK�OHYHO�RI�DVVXU�

DQFH�XQOHVV�LW�LV�VXSSRUWHG�E\�D�IRUPDO�VHPDQWLFV�WKDW�GHWHUPLQHV�LQWHU� SUHWDWLRQV�RI�IRUPXODV��,Q�WKLV�FDVH��D�IRUPXOD�φ�LV�D�YDOLG�FRQVHTXHQFH�RI D�VHW�Ψ�RI�IRUPXODV�LI�DQG�RQO\�LI�HYHU\�LQWHUSUHWDWLRQ�WKDW�VDWLVILHV�Ψ�DOVR VDWLVILHV� φ�� 7KH� SUREOHP� LV� WKDW�� ZLWKRXW� D� IRUPDO� VHPDQWLFV�� WKH� SURRI FKHFNHU�PLJKW�QRW�EH�VRXQG�DQG�PLJKW�DFFHSW�SURRIV�RI�IDOVH�FRQMHFWXUHV� $�IRUPDO�VHPDQWLFV�WKXV�LQYROYHV�DQ�LQWHUSUHWDWLRQ�IXQFWLRQ�IRU�IRUPXODV DQG� DQ� DVVRFLDWHG� GHPRQVWUDWLRQ� WKDW� D� V\VWHP·V� SURRI� WHFKQLTXHV� DUH

)RUPDO�0HWKRGV�DQG�0RGHOV ���

VRXQG�� )RUPDO� ORJLFDO� V\VWHPV� LQ� WKH� WUDGLWLRQ� RI� +LOEHUW�� 7DUVN\�� DQG RWKHUV�KDYH�H[FHOOHQW�UHSXWDWLRQV�IRU�VRXQGQHVV�� EXW� WKH\� DUH� QRW� VXLW� DEOH� IRU� SUDFWLFDO� ZRUN� EHFDXVH� WKH\� IXQGDPHQWDOO\� ODFN� SRZHUIXO� VH� PDQWLF� FRQYHQWLRQV� >:,//��@� QHHGHG� IRU� UHDGDEOH� VSHFLILFDWLRQV� DQG SURRIV�>)$50��@��7KLV� FRQFOXVLRQ� KDV� EHHQ� LQGHSHQGHQWO\� DUULYHG� DW� LQ DQ�XQSXEOLVKHG�´5HYLHZ�RI�7RROV�DQG�0HWKRGV�IRU�6\VWHP�$VVXUDQFH�µ�E\ $QGUHZV�DQG�0DF(ZHQ�

0DWKHPDWLFDO� IRUPDOLVP� KDV� TXLWH� GLIIHUHQW� JRDOV� IRU� DXWRPDWHG UHDVRQLQJ�WKDQ�IRU�PDWKHPDWLFDO�IRXQGDWLRQV��,Q�WKH�IRUPHU�FRQ� WH[W�� WKH� IRUPDOLVP� H[LVWV� SULPDULO\� WR� DLG� KXPDQ� EHLQJV� LQ� WKH WDVN� RI� SURYLQJ� PDWKHPDWLFDO� UHVXOWV�� ,Q� WKH� ODWWHU� FRQWH[W�� WKH JRDO�LV�WR�FODULI\�SKLORVRSKLFDO�TXHVWLRQV�DERXW�EDVLF�PDWKHPDWL� FDO�TXHVWLRQV��H�J���´:KDW�LV�D�SURRI"µ��´:KDW�DUH�WKH�IXQGDPHQWDO OLPLWDWLRQV�RI�PDWKHPDWLFDO�UHDVRQLQJ"µ��HWF��7KH�SUDFWLFDO�FRQVH� TXHQFH�LV�WKDW�PDWKHPDWLFDO�IRUPDOLVP�IRU�DXWRPDWHG� UHDVRQLQJ RXJKW�WR�UHVHPEOH�TXLWH�FORVHO\�WKH�ODQJXDJH�RI�RUGLQDU\�PDWKH� PDWLFV�

)RUWXQDWHO\�� WKH� JRDOV� RI� IRUPDO� VRXQGQHVV� DQG� H[SUHVVLYHQHVV� DUH� QRW IXQGDPHQWDOO\� LQFRQVLVWHQW�� $Q� ,QWHUDFWLYH� 0DWKHPDWLFDO� 3URRI� 6\VWHP �,036��KDV�EHHQ�GHYHORSHG�DW�0,75(�>)$50��@�WKDW�QRW�RQO\�KDV�DQ�H[� SUHVVLYH�VHPDQWLFV�DQG�FRQYHQLHQW�DXWRPDWHG�SURRI�PHFKDQLVP��EXW�DOVR LV� EDVHG� RQ� D� ULJRURXV�� IRUPDO� VHPDQWLFV� ZKRVH� VRXQGQHVV� KDV� EHHQ GHPRQVWUDWHG�UHODWLYH�WR�ROGHU��EHWWHU�NQRZQ�IRUPDO�V\VWHPV�>)$50��@�

3UREOHPV�LQ�WKH�XVH�RI�IRUPDO�PHWKRGV��6LQFH�WKH�7&6(&�ZDV�ILUVW SXEOLVKHG�LQ�������WKHUH�KDYH�EHHQ�IHZ�VXFFHVVHV�LQ�SURGXFLQJ�FRPSXW� LQJ�V\VWHPV�EDFNHG�XS�E\�IRUPDO�DVVXUDQFH��$�OHQJWK\�LQYHVWLJDWLRQ�LQWR WKH�XVH�RI�IRUPDO�PHWKRGV�LQ�WUXVWHG�V\VWHPV�E\�0DUYLQ�6FKDHIHU�KDV�WKH IROORZLQJ�FRQFOXVLRQ�

+HQFH��WKHUH�LV�VRPH�UHDVRQ�WR�EHOLHYH�WKDW�WKHUH�LV�YDOXH�LQ�WKH YHU\�DQDO\VLV�UHTXLUHG�WR�SHUIRUP�WKH�H[HUFLVH�RI�SURGXFLQJ�D�IRU� PDO�DEVWUDFWLRQ�RI�WKH�VHFXULW\�HQIRUFLQJ�SRUWLRQ�RI�D�V\VWHP�GH� VLJQ����+RZHYHU��LW�DSSHDUV�WKDW�WKH�DGGHG�YDOXH�LV�PXFK�OHVV�WKDQ ZKDW�LV�QHHGHG�WR�FRQFOXGH�WKDW�D�SURGXFW�ZLWK�D�YHULILHG�)7/6�LV ´VHFXUHµ� RU� HYHQ� ´PRUH� VHFXUHµ� WKDQ� D� FRPSDUDEOH� %�� SURGXFW >6&+$��@�

6FKDHIHU�LGHQWLILHV�PDQ\�RI�WKH�XQGHUO\LQJ�SUREOHPV�LQ�WKH�XVH�RI�IRUPDO PHWKRGV��7KH�SUREOHPV�PD\�EH�JURXSHG�LQWR�WKUHH�PDLQ�FODVVHV�KDYLQJ WR�GR�ZLWK�SUHPDWXUH�DSSOLFDWLRQ�RI�WKH�PHWKRGRORJ\��KROHV�LQ�WKH�FKDLQ

��� ,QIRUPDWLRQ�6HFXULW\

RI�UHDVRQLQJ��DQG�PLVDSSOLFDWLRQ�RI�WKH�PD[LP�´D�FKDLQ�LV�DV�VWURQJ�DV�LWV ZHDNHVW�OLQN�µ (DUO\�HIIRUWV�WR�GHYHORS�WUXVWHG�V\VWHPV�XQGHUHVWLPDWHG�SUDJPDWLF�GLI�

ILFXOWLHV�LQYROYHG�LQ�GHVLJQLQJ��EXLOGLQJ��DQG�PDUNHWLQJ�WKHP��$WWHPSWV�WR SURGXFH�$��V\VWHPV�ZLWKRXW�ILUVW�GHYHORSLQJ�DQG�ILHOG�WHVWLQJ�%���%���RU %�� V\VWHPV� OHG� WR� H[SHQVLYH�� SRRUO\� GHVLJQHG� SURGXFWV� ZLWK� QR� HVWDE� OLVKHG� PDUNHW�� 7KHVH� HIIRUWV� ZHUH� DFFRPSDQLHG� E\� D� EHOLHI� WKDW� 1&6&� HQGRUVHG�YHULILFDWLRQ�WRROV�ZHUH�EHWWHU�WKDQ�PDWKHPDWLFDO�(QJOLVK��8QWLO UHFHQWO\��WKH�DYDLODEOH�WRROV�KDYH�EHHQ�XQHYDOXDWHG�SURWRW\SHV��DQG�WKHUH KDV�EHHQ�OLWWOH�SXEOLVKHG�H[SHULHQFH�LQ�XVLQJ�WKHP��7KH�WZR�H[LVWLQJ�V\V� WHPV�DUH�ZLWKRXW�D�IRUPDO�EDVLV��IRU�WKH�PRVW�SDUW��DQG�WKH\�ODJ�EHKLQG WKH� FXUUHQW� VWDWH� RI� WKH� DUW� LQ� DXWRPDWLF� WKHRUHP� SURYLQJ�� +RZHYHU� HYDOXDWLRQV�RI�WKH�WZR�FXUUHQWO\�VXSSRUWHG�WRROV�KDYH�UHFHQWO\�EHHQ�SHU� IRUPHG��DQG�UHOHYDQW�H[DPSOHV�RI�WKHLU�XVH�DUH�QRZ�DYDLODEOH�

Figure 3. TCSEC assurance requirements.

)LJXUH� �� VXPPDUL]HV� 7&6(&� UHTXLUHPHQWV� IRU� WKH� XVH� RI� IRUPDO PHWKRGV� LQ� V\VWHPV� HYDOXDWHG� DW� %�� DQG� DERYH�� 'RWWHG� OLQHV� LQGLFDWH SRWHQWLDO� ZHDNQHVVHV� IRXQG� DW� %��� %��� DQG�RU� $��� 7R� EHJLQ� ZLWK�� WKH 7&6(&�GRHV�QRW�GLVWLQJXLVK�EHWZHHQ�WKH�V\VWHP�VHFXULW\�SROLF\�HQIRUFHG E\� WKH� $,6� DQG� RUJDQL]DWLRQDO� SROLFLHV� IRU� XVH� RI� WKH� V\VWHP�� &RQVH� TXHQWO\��WKHUH�LV�QR�UHTXLUHPHQW�IRU�YHQGRUV�WR�PDS�WKHLU�V\VWHP�VHFXULW\

)RUPDO�0HWKRGV�DQG�0RGHOV ���

SROLF\�WR�KLJKHU�OHYHO�REMHFWLYHV��LQFOXGLQJ�WKH�´&RQWURO�2EMHFWLYHVµ�RI�WKH 7&6(&� LWVHOI�� ,Q� WKH� FDVH� RI� QRQGLVFORVXUH� REMHFWLYHV�� VRPH� LQIRUPDO DQDO\VLV�LV�JLYHQ�LQ�WKH�7&6(&��DQG�D�YHQGRU�FRXOG�YROXQWDULO\�SODFH�DG� GLWLRQDO� LQIRUPDWLRQ� UHJDUGLQJ� KLJKHU�OHYHO� REMHFWLYHV� LQ� WKH� UHTXLUHG ´3KLORVRSK\�RI�3URWHFWLRQ�µ 7KH�IRUPDO�PRGHO�LV�W\SLFDOO\�D�VXEMHFW�SRLQW�RI�YLHZ�PRGHO�ZKRVH�GHIL�

QLWLRQ� RI� VHFXULW\� GHVFULEHV� WKH� UHIHUHQFH� PRQLWRU� LQWHUIDFH� LQ� WHUPV� RI LQWHUQDO� FRQVWUDLQWV� RQ� FRQWUROOHG� HQWLWLHV�� 7KHUH� LV� QR� UHTXLUHPHQW� WR PRGHO�WKH�V\VWHP�DV�D�ZKROH�DQG�WKXV�QR�IRUPDO�GHPRQVWUDWLRQ�WKDW�WKH SXUSRUWHG�7&%�KDV�EHHQ�FRUUHFWO\�LGHQWLILHG��3RUWLRQV�RI�WKH�7&%�QRW�GL� UHFWO\�LQYROYHG�LQ�DFFHVV�FRQWURO�DUH�W\SLFDOO\�QRW�PRGHOHG��DQG�WKLV�WUD� GLWLRQ� LV� DIILUPHG� LQ� WKH� 7UXVWHG� 1HWZRUN� ,QWHUSUHWDWLRQ� RI� WKH� 7&6(& >1&6&��D@��'HYLFHV�DUH�QRW�H[SOLFLWO\�PRGHOHG��7&%�DGPLQLVWUDWLYH�VRIW� ZDUH�LV�QRW�PRGHOHG��7\SLFDOO\��YDULRXV�VXEMHFWV�ZLWKLQ�WKH�7&%�DUH�H[� HPSW� IURP� VRPH� SDUW� RI� WKH� DFFHVV� PHGLDWLRQ� HQIRUFHG� E\� WKH� 7&%� RQ QRQ�7&%�VXEMHFWV��DQG�WKH�SURSHU�XVH�RI�WKHVH�H[HPSWLRQV�LV�QRW�PRG� HOHG� $W�%��DQG�DERYH��WKHUH�LV�QR�H[SOLFLW�UHTXLUHPHQW�WR�PDNH�DQ�(QJOLVK

WUDQVODWLRQ�RI�WKH�IRUPDO� PRGHO� DYDLODEOH� IRU� QRQVSHFLDOLVWV�� WKHUHE\� UH� GXFLQJ� WKH� OLNHOLKRRG� RI� LWV� FRQVLVWHQF\� ZLWK� WKH� V\VWHP� VHFXULW\� SROLF\ DQG�descriptive top-level specification��'7/6�� 8QPRGHOHG�SRUWLRQV�RI�WKH�7&%�DUH�FRQVWUDLQHG�E\�WKH�V\VWHP�VHFXULW\

SROLF\�DQG�WKH�'7/6��EXW�MXVWLILFDWLRQ�RI�WKH�'7/6�UHODWLYH�WR�WKH�V\VWHP VHFXULW\�SROLF\�LV�UHTXLUHG�RQO\�DW�%���$W�%��WKHUH�LV�DOVR�QR�UHTXLUHPHQW WR�MXVWLI\�WKH�'7/6�UHODWLYH�WR�HLWKHU�WKH�IRUPDO�PRGHO�RU�WKH�V\VWHP�VHFX� ULW\�SROLF\��7KH�)7/6�LV�UHTXLUHG�RQO\�DW�$���7KH�)7/6�PXVW�EH�XVHG�LQ V\VWHP� WHVWLQJ�� EXW� WKHUH� LV� QR� UHTXLUHG� FRUUHVSRQGHQFH� EHWZHHQ� WKH )7/6� DQG� WKH� '7/6�� DQG� XQIRUPDOL]HG� SRUWLRQV� RI� WKH� '7/6� QR� ORQJHU KDYH�WR�EH�WHVWHG��7KH�LPSOHPHQWDWLRQ�FRUUHVSRQGHQFH�EHWZHHQ�WKH�)7/6 DQG�WKH�VRXUFH�FRGH�FDQ�WDNH�WKH�IRUP�RI�D�FKHDS�V\QWDFWLF�FRPSDULVRQ� DQG� XQUHVROYHG� VHPDQWLF� GLVFUHSDQFLHV� EHWZHHQ� WKH� )7/6� DQG� WKH� LP� SOHPHQWDWLRQ� DUH� FRPPRQ�� )RU� H[DPSOH�� WKH� )7/6� PLJKW� XVH� LQILQLWH VWRUDJH�EXIIHUV�WR�DYRLG�VWRUDJH�DOORFDWLRQ�LVVXHV� ,Q�VXPPDU\��D�VWURQJ�OLQN�EHWZHHQ�DQ�)7/6�DQG�D�IRUPDO�PRGHO�QHHG

QRW�EH�XVHIXO��LI�VXUURXQGLQJ�OLQNV�DERYH�DQG�EHORZ�DUH�ZHDN�RU�PLVVLQJ� 7KH�PD[LP�WKDW�´D�FKDLQ�LV�RQO\�DV�VWURQJ�DV�LWV�ZHDNHVW�OLQNµ�GRHV�QRW IXOO\�DSSO\�WR�WKH�XVH�RI�IRUPDO�PHWKRGV��KRZHYHU��7KH�LGHDV�DQG�VSHFLIL� FDWLRQV�DVVRFLDWHG�ZLWK�WKH�GHYHORSPHQW�RI�D�VHFXUH�V\VWHP�WHQG�WR�IRUP DQ�H[SRQHQWLDO�KLHUDUFK\��ZLWK�WKH�YHQGRU·V�GHILQLWLRQ�RI�VHFXULW\�DW�WKH WRS�� (DFK� VXFFHHGLQJ� OD\HU� �UXOHV� RI� RSHUDWLRQ�� WRS�OHYHO� GHVFULSWLRQ� SVHXGRFRGH�� 7&%� FRGH�� DQG� KDUGZDUH� GHVFULSWLRQ�� LV� VHYHUDO� WLPHV� WKH VL]H�RI�WKH�SUHYLRXV�OD\HU��ZLWK�SHUKDSV�D�KXQGUHG�OLQHV�LQ�WKH�GHILQLWLRQ RI�VHFXULW\�DQG����.�OLQHV�RI�7&%�VRXUFH�FRGH��$V�D�UHVXOW��DQ�HUURU�QHDU WKH�WRS�RI�WKLV�KLHUDUFK\�PD\�DIIHFW�D�ODUJH�SRUWLRQ�RI�WKH�ILQLVKHG�FRGH DQG�LV�OLNHO\�WR�EH�IDU�PRUH�VHULRXV�WKDQ�DQ�HUURU�IDUWKHU�GRZQ�

��� ,QIRUPDWLRQ�6HFXULW\

7KH�SURSHU�XVH�RI�IRUPDO�PHWKRGV��)RUPDO�PHWKRGV�DUH�EHVW�VXLWHG�WR WKH�VWXG\�RI�UHODWLYHO\�VPDOO��DEVWUDFW�LVVXHV��5HVHDUFKHUV�URXWLQHO\�SUR� YLGH�IRUPDO�VHFXULW\�PRGHOV��DQG�WKH�FRVW�HIIHFWLYHQHVV�RI�IRUPDO�PHWKRGV IRU�WKLV�SXUSRVH�LV�JHQHUDOO\�DFFHSWHG��)RUPDO�PHWKRGV�DUH�HVSHFLDOO\�LP� SRUWDQW�LQ� WKRVH� FDVHV� ZKHUH� WUDGLWLRQDO� V\VWHP� WHVWLQJ� LV� QRW� HIIHFWLYH� )RU� H[DPSOH�� RQH� GRHV� QRW� VLPSO\� WDNH� GRZQ� WKH� ,QWHUQHW� IRU� V\VWHP WHVWLQJ� �DW� OHDVW� QRW� ZLWKRXW� JHWWLQJ� D� ORW� RI� DWWHQWLRQ��� 7KXV�� IRUPDO PHWKRGV�KDYH�WKHLU� KLJKHVW� SD\RII� DW� WKH� HDUO\� VWDJHV� RI� SURGXFW� GHYHO� RSPHQW�DQG�LQ�VWXG\LQJ�JOREDO�SURSHUWLHV�RI�ODUJH�V\VWHPV� )RUPDO�PHWKRGV�FDQ�QHYHU�IXOO\�UHSODFH�LQIRUPDO�GHYHORSPHQW�PHWKRGV�

DQG�FDQ�QHYHU�VXEVWLWXWH�IRU�UHDO�H[SHULHQFH��$Q�$��V\VWHP�PDNHV�PXFK PRUH�VHQVH�DV�D�IROORZ�RQ�WR�D�VHULHV�RI�%��DQG�%��RU�%��V\VWHPV�WKDQ�DV D�QHZ�V\VWHP�GHYHORSHG�IURP�VFUDWFK� 1&6&�HQGRUVHG�YHULILFDWLRQ�WRROV�PDNH�VHQVH�DV� EHQFKPDUNV� WKDW� HV�

WDEOLVK� DQ� H[SHFWHG� OHYHO� RI� ULJRU�� 7KH\� QHHG� QRW� UXOH� RXW� WKH� XVH� RI PDWKHPDWLFDO� (QJOLVK� RU� RI� QHZHU�� XQHQGRUVHG� YHULILFDWLRQ� WRROV�� LI� WKH UHVXOWLQJ�HYLGHQFH�FRPSDUHV�IDYRUDEO\�ZLWK�WKDW�RI�VLPLODU�HIIRUWV�EDVHG RQ�WKH�XVH�RI�HQGRUVHG�WRROV��7KH� 7&6(&� ZRUGLQJ� DOUHDG\� FRQYH\V� WKLV SROLF\�RQ�WKH�XVH�RI�HQGRUVHG�WRROV��DQG�LW�ZRXOG�EH�FRXQWHUSURGXFWLYH�WR VWUHQJWKHQ�WKH�UHTXLUHPHQW�EH\RQG�ZKDW�LV�H[SOLFLWO\�VWDWHG�