Requirement Engineering for Trust Management : Model, Methodology Reasoning P. Giorgini, F. Massacci, J. Mylopoulos, N. Zannone, “Requirements Engineering for Trust Management: Model, Methodology, and Reasoning”, International Journal of Information Security 5:4, pp , October Presented by: Ramya Porumamilla

Summary Proposes an enhancement to Tropos by: * Separating actors, tasks, resources and social dependencies. * Defining the trust relationship between the actors. * Creating a functional relationship model. Existing Tropos methodology: Depender  Dependum  Dependee Provides a formal framework for modeling and analysing security and trust requirements.

Proposed Solution Introduces a trust relationship model to tropos - Trust, delegation, offer and ownership Methodology: 1. design a trust model among the actors of the systems. 2. identify who owns goals, tasks, or resources and who is able to fulfill goals, execute tasks or deliver resources 3. define functional dependencies and delegations of goals among agents building a functional model Finally, supports automatic verification of security requirements and trust relationships using formal modeling language.

Appreciation The proposed solution introduces a trust relationship model to tropos - Trust, delegation, offer and ownership Provides a way to abstract trust and functional models using diagrams – good Visual Language Allows automatic verification of the security requirements and trust relationships using formal modelling language – Datalog. Applications in Medical, Banking and other large applications which require high level of security Offers a formal modelling of the entire system including the its working environment.

Critical Comment (1) The proposed methodology is feasible only for large scale applications which deal with sensitive information like Medical and Banking applications Usability of the Visual Language (diagrams) is not verified in this paper. - No evaluations using formal Visual Language frameworks: eg: Cognitive Dimensions: abstraction gradient, consistency, diffuseness, error-proneness, premature commitment and visibility.

Critical Comment (2) The automatic verification of security requirements using formal modelling language is not clearly explained and evaluated. Feasibility of such a system is still debatable.

Conclusions Existing Tropos methodology: Depender  Dependum  Dependee The paper proposes an enhancement to Tropos by: * Separating actors, tasks, resources and social dependencies. * Defining the trust relationship between the actors. * Creating a functional relationship model. Provides a formal framework for modeling and analysing security and trust requirements. However, formal usability studies are required to evaluate the usefulness of this system.

Question Can this system be extended so that it can be used as a Visual Language tool ? Automatic generation of the formal modelling language from the security and trust relationship diagrams as shown: