Approaches to Modelling Security Scenarios with Domain-Specific Languages (Transcript of Discussion)

摘要

Good morning, I'm Phil Brooke. My co-authors hail from York, and I'm based at Teesside. For a couple of years we've been looking at how people interact with protocols, and the implicit protocols in how people carry out transactions. What we want to do is get some answers in terms of: if I change a process for how I run a particular transaction, do I get a benefit from it? The motivation for this came originally from the Identity Card Act, which has since been repealed in the UK. So our scenarios involve somebody trying to buy some age restricted goods. Rather than just eyeballing the person and saying, "I think you're over 18", or asking for some other identification which may or may not be easily forged, you would have this gold standard ID card, and they'd be able to look at it and say, "yes, of course you are old enough," and on we go. Our question wasn't so much are these good or bad things, but how much difference would it make to us and can I measure that? Can I model it?