Model Checking for E-Commerce Control and Assurance

Abstract

Model checking is a promising technique for the verification of complex software systems. As the use of the Internet for conduct business (e-business) extends the reach of many businesses, well-designed software becomes the foundation of reliable implementation of e-business processes. These distributed, electronic methods of conducting transactions place important reliance on the control structures embedded in the transaction processes. Deficiencies in control structures of processes that support e-business can lead to loss of physical assets, digital assets, money, and consumer confidence. Yet, assessing the reliability of e-business processes is both complex and time consuming.

This paper explicates how model-checking technology can aid in the design and assurance of e-business processes in complex digital environments. Specifically, we demonstrate how model checking can be used to verify e-business requirements for money atomicity, goods atomicity, valid receipt, and communication link failures. These requirements are fundamental to many e-business applications. Model checking can be used to test a broad range of systems requirements - not only for system designers, but also for auditors and security specialists. Systems that are examined by auditors need to have adequate controls built in prior to implementation and will need adequate auditing after implementation to ensure that none of the processes have been corrupted. Model checkers may also provide value in examining the processes of highly integrated applications as found in enterprise resource planning systems.

Keywords: e-business, model checking, atomicity, process and communication protocols, data typing