140 likes | 231 Views
Detection of Conflicts in Electronic Contracts. Stephen Fenech Gordon J. Pace University of Malta Gerardo Schneider University of Oslo. TexPoint fonts used in EMF. Read the TexPoint manual before you delete this box.: A A A A. Motivation. Are different services compatible together?
E N D
Detection of Conflicts in Electronic Contracts Stephen Fenech Gordon J. Pace University of Malta Gerardo Schneider University of Oslo TexPoint fonts used in EMF. Read the TexPoint manual before you delete this box.: AAAA
Motivation • Are different services compatible together? • (is this (almost) just the beauty criterion we saw yesterday?) • Different views of contracts: • Contracts as properties • A meta-level view of contracts • Composition of services/systems means composition of contracts
The CL View of Contracts • An action-based deontic logic • Enables specification of obligations, prohibitions and permissions • Reparations as (possibly nested) CTDs, CTPs
What are Conflicts? • Conflicts arise when the contract enforces contradictory actions by one or more signatories. • Obliged and forbidden from doing an action • Permitted and forbidden from performing an action • Being obliged to perform two conflicting actions • Being obliged and permitted to perform two conflicting actions
Semantic Detection of Conflicts • A contract is conflict-free if for any sequence of non-violating actions, a contract monitor will not end up in a state where the contract enforces a conflict. • This requires a trace semantics of CL • on finite traces; and • which preserves deontic information
Deontic Trace Semantics of CL • Original trace semantics: ¾²1c • Example: [{a,b}, {b}, …] ²1 [a]O(b) Æ [b]P(c)
Deontic Trace Semantics of CL • Three problems: • Infinite traces are not always constructible: 8¾¢¾21O(a) ÆF(a) • Permission has no role in the semantics: [ {b}, … ] ²1 F(a) ÆP(a) • No deontic information is used in the semantics
Deontic Trace Semantics of CL • New trace semantics: ¾, ¾d²fc • Correctness: ¾²1 c , 9¾d¢8n¢¾(0..n), ¾d(0..n)²fc
Automata with Deontic Information • Given a CL contract c, A(c) = hS, A&, s0, T, V, I, ±i is an automaton: • S is the set of states, s0 the initial state • A& is the set of concurrent actions • T= S£A&£S are the labelled transitions • V is the violation state • I : S!CL tags states with CL clauses • ± labels states with deontic information • The language of such an automaton Accept(A(c)) is the set of traces accepted by the automaton, not passing through state V.
Correctness Result Theorem: Given a CL contract c: ¾, ¾d²f c if and only if ¾2Accept(A(c)) A contract is conflict-free if and only if its automaton representation is conflict-free.
CLAN: An Implementation [c]O(b)^[a]F(b)
Other Analysis using the Automaton • Superfluous Clauses • State is labelled with a deontic notion multiple times • Contract Query • What does contract enforce after a sequence of actions • What actions would lead to a specific obligation
Other Analysis using the Automaton • Unreachable clauses • Clauses in the contract which are superfluous • Overlapping clauses • Clauses repeating similar or identical deontic properties
Conclusions • Sound and complete decision algorithm for conflict detection of CL contracts: • Based on a trace semantics of CL • Prototype implementation • Used on a case study involving an airline company check-in desk. • Currently looking into combining this with runtime verification.