Assurance for CyberSecurity with Assume-Guarantee Reasoning

Design of cybersecurity solutions for a network is a challenging problem as it involves the integration of several complex components such as routers, servers, computers, smart devices, that include not only essential networking algorithms but also security algorithms. This is further complicated by the need to have robust security policies implemented to prevent violation of confidentiality as the networked devices interact. The design of such complex networked systems demand a more rigorous approach to the modeling and analysis at a higher level of abstraction, which can be inherited from the field of formal methods in software engineering for safety critical systems. Presently, network or security engineers do not use a formal method based software engineering approach to design and build cybersecurity systems. Thus, we propose a software engineering based formal approach to model and analyze cybersecurity, that along with identification of concrete requirements enables automated analysis to guarantee cybersecurity properties are satisfied within the network. In this research paper, we discuss an ontology guided assume-guarantee based formal approach to model and analyze a designed network. To enable this approach, a domain specific language is designed that allows association of assumptions with components in the network that allows verifying the satisfaction of contracts that are guarantees. The formal language designed includes reserved words are guided by the CyberSecurity domain and the semantic reasoning is based on formal architectural representation.