Policy Verification Research Articles

Sample-based bounds for coherent risk measures: Applications to policy synthesis and verification

Autonomous systems are increasingly used in highly variable and uncertain environments giving rise to the pressing need to consider risk in both the synthesis and verification of policies for these systems. This paper first develops a sample-based method to upper bound the risk measure evaluation of a random variable whose distribution is unknown. These bounds permit us to generate high-confidence verification statements for a large class of robotic systems in a sample-efficient manner. Second, we develop a sample-based method to determine solutions to non-convex optimization problems that outperform a large fraction of the decision space of possible solutions. Both sample-based approaches then permit us to rapidly synthesize risk-aware policies that are guaranteed to achieve a minimum level of system performance. To showcase our approach in simulation, we verify a cooperative multi-agent system and develop a risk-aware controller that outperforms the system's baseline controller. Our approach can be extended to account for any g-entropic risk measure.

Blockchain-enabled EHR access auditing: Enhancing healthcare data security

In the realm of modern healthcare, Electronic Health Records EHR serve as invaluable assets, yet they also pose significant security challenges. The absence of EHR access auditing mechanisms, which includes the EHR audit trails, results in accountability gaps and magnifies security vulnerabilities. This situation effectively paves the way for unauthorized data alterations to occur without detection or consequences. Inadequate EHR compliance auditing procedures, particularly in verifying and validating access control policies, expose healthcare organizations to risks such as data breaches, and unauthorized data usage. These vulnerabilities result from unchecked unauthorized access activities. Additionally, the absence of EHR audit logs complicates investigations, weakens proactive security measures, and raises concerns to put healthcare institutions at risk. This study addresses the pressing need for robust EHR auditing systems designed to scrutinize access to EHR data, encompassing who accesses it, when, and for what purpose. Our research delves into the complex field of EHR auditing, which includes establishing an immutable audit trail to enhance data security through blockchain technology. We also integrate Purpose-Based Access Control (PBAC) alongside smart contracts to strengthen compliance auditing by validating access legitimacy and reducing unauthorized entries. Our contributions encompass the creation of audit trail of EHR access, compliance auditing via PBAC policy verification, the generation of audit logs, and the derivation of data-driven insights, fortifying EHR access security.

Emission analysis based on mixed traffic flow and license plate recognition model

With the rising ownership of new energy vehicles (NEVs), accurate road traffic emission estimations are crucial. This study combined mixed traffic flow and license plate recognition (LPR) using improved 3D convolutional neural network (3D-CNN) and Transformer models. The 3D-CNN model is designed for vehicle localization and traffic flow data acquisition, while the Transformer-based LPR model accurately recognizes license plates, distinguishing NEVs from conventional vehicles. The overall model is validated by the training and test datasets, and then with field application along a primary arterial segment in the South 2nd Ring Road, Xi’an, China. The results demonstrate capability for the traffic emission approximation of the mixed traffic flow including new energy vehicles, revealing that mixed traffic flow identification plays an important role in road emission approximation. Results and procedures of the study may provide benchmark for the subsequent research and the verification of related transportation policies.

Verification of Death by Neurologic Criteria: A Survey of 12 Organ Procurement Organizations Across the United States.

The Center for Medicare and Medicaid Services requires Organ Procurement Organizations (OPOs) to verify and document that any potential organ donor has been pronounced dead per applicable legal requirements of local, state, and federal laws. However, OPO practices regarding death by neurologic criteria (DNC) verification are not standardized, and little is known about their DNC verification processes. This study aimed to explore OPO practices regarding DNC verification in the United States. An electronic survey was sent to all 57 OPOs in the United States from June to September 2023 to assess verification of policies and practices versus guidelines, concerns about policies and practices, processes to address concerns about DNC determination, and communication practices. Representatives from 12 OPOs across six US regions completed the entire survey; 8 of 12 reported serving > 50 referral hospitals. Most respondents (11 of 12) reported comparing their referral hospital's DNC policies with the 2010 American Academy of Neurology Practice Parameter and/or other (4 of 12) guidelines. Additionally, most (10 of 12) reported independently reviewing and verifying each DNC determination. Nearly half (5 of 12) reported concerns about guideline-discordant hospital policies, and only 3 of 12 thought all referral hospitals followed the 2010 American Academy of Neurology Practice Parameter in practice. Moreover, 9 of 12 reported concerns about clinician knowledge surrounding DNC determination, and most (10 of 12) reported having received referrals for patients whose DNC declaration was ultimately reversed. All reported experiences in which their OPO requested additional assessments (11 of 12 clinical evaluation, 10 of 12 ancillary testing, 9 of 12 apnea testing) because of concerns about DNC determination validity. Accurate DNC determination is important to maintain public trust. Nearly all OPO respondents reported a process to verify hospital DNC policies and practices with medical society guidelines. Many reported concerns about clinician knowledge surrounding DNC determination and guideline-discordant policies and practices. Educational and regulatory advocacy efforts are needed to facilitate systematic implementation of guideline-concordant practices across the country.

Managing health through environmental policies. Analysis for European Union countries

PurposeEnvironmental degradation resulting from human activities may adversely affect human health in multiple ways. Until now, policies aimed at mitigating environmental problems such as climate change, environmental pollution and damage to biodiversity have failed to clearly identify and drive the potential benefits of these policies on health. The conducted study assesses and demonstrates how specific environmental policies and instruments influence perceived human health in order to ensure input for a data-driven decision process.Design/methodology/approachThe study was conducted for the 2004–2020 period in European Union (EU) countries with the use of dynamic panel data modeling. Verification of specific policies' impact on dependent variables allows to indicate this their effectiveness and importance. As a result of the computed dynamic panel data models, it has been confirmed that a number of significant and meaningful relationships between the self-perceived health index and environmental variables can be identified.FindingsThere is a strong positive impact of environmental taxation on the health index, and the strength of this relationship causes effects to be observed in the very short term, even the following year. In addition, the development of renewable energy sources (RES) and the elimination of fossil fuels from the energy mix exert positive, although milder, effects on health. The reduction of ammonia emissions from agriculture and reducing noise pollution are other health-supporting factors that have been shown to be statistically valid. Results allow to identify the most efficient policies in the analyzed area in order to introduce those with the best results or a mix of such measures.Originality/valueThe results of the authors' research clearly indicate the health benefits of measures primarily aimed at improving environmental factors, such as environmental taxes in general. The authors have also discovered an unexpected negative impact of an increase in the share of energy taxes in total taxes on the health index. The presented study opens several possibilities for further investigation, especially in the context of the rapidly changing geopolitical environment and global efforts to respond to environmental and health challenges. The authors believe that the outcome of the authors' study may provide new arguments to policymakers pursuing solutions that are not always easily acceptable by the public.

A machine-learning approach to a mobility policy proposal

The objective of the URBANITE project is to design an open-data, open-source, smart-city framework to enhance the decision-making processes in European cities. The framework's basis is a robust and user-friendly simulation tool that is supplemented with several innovative service modules. One of the modules, a multi-output, machine-learning unit, is deployed on the simulation results, enabling city officials to more effectively analyse vast quantities of data, discern patterns and trends, and so facilitate advanced policy decisions. The city's decision makers define potential city scenarios, key performance indicators, and a utility function, while the module assists in identifying the policy that is best aligned with the stipulated constraints and preferences. One of the main improvements is a speeding up of the policy testing for the decision makers, reducing the time needed for one policy verification from 3 hours to around 10 seconds. The system was evaluated for Bilbao's Moyua area, where it suggested strategies that could result in a decrease in emissions of more than 5% CO2, NOx, PM in the selected area and a broader part of the city with a machine-learning accuracy of 91%. The system was therefore able to provide valuable insights into effective policies for restricting private traffic in specific districts and identifying the most advantageous times for these restrictions.

Kano: Efficient Cloud Native Network Policy Verification

Kano: Efficient Cloud Native Network Policy Verification

Optical assessment of the spatial variation in total soil carbon using laser-induced breakdown spectroscopy

Soil carbon storage is a substantial factor in the global carbon cycle. Carbon sequestration in agricultural soils, and the assessment and validation of soil carbon storage, are crucial for the mitigation of agricultural greenhouse gas emissions and for steering towards sustainable farming practices. Enforcement and verification of carbon sequestration policies, methods, and models require extensive soil carbon monitoring capability. However, current conventional laboratory-based methods for soil carbon estimation are laborious, expensive, and time-consuming. In this work, we have developed a compact, robust, and field-capable experimental device based on laser-induced breakdown spectroscopy (LIBS) for the rapid assessment of total soil carbon content and its spatial distribution in mineral soils. The carbon content quantification was performed using a spectral line of carbon at a wavelength of 193.1 nm emitted from the laser-induced plasma plume. The LIBS measurements were performed on soil samples collected from 28 different locations and various depths (up to 1 m) of a test field cultivated with a forage legume (red clover - Trifolium pratense, L.) and grass (Timothy - Phleum pratense, L.) mixture in eastern Finland. A calibration model was established based on a limited and randomly chosen sample set and validated by comparing soil carbon estimates obtained from various locations in the test field using the dry combustion (LECO) method. Further, we demonstrate here the usefulness of LIBS methodology for mapping three-dimensional carbon distribution at the test field. We emphasize here that the calibration model can be generalized to other sample areas under similar soil type with a relative error of less than 10 % and possesses potential for fast on-site determination of spatial variation in total soil carbon, reducing substantially the need of time-consuming sample processing in laboratory. Therefore, LIBS enables frequent and extensive spatial and temporal soil carbon mapping and has the potential to become part of the future carbon monitoring network.

Three Pillars of Communicative Competence

The main point of view demonstrated in the present paper is to express criticism to those program of foreign language studies which still rely on the traditional approach to language education and favor the development of linguistic competence in students. Harmonious functioning of the contemporary world depends, to much extent, on human coexistence and communication both on the micro and macro scale. In the case of the macro scale contacts, the English language has been sanctioned an international means of communication. The examination of the Internet resources with reference to higher education language programs of studies as well as programs offered by some language schools, shows that the teaching/learning process is mainly concentrated on developing students’ linguistic competence. The Polish reality of practical English application in a variety of situations shows that the language user’s knowledge, when limited to the linguistic sphere only, is not sufficient. Therefore, the aim of the present paper is to turn the reader’s attention to the need of verification of educational policy, adopted by many higher education institutions, and expand the offered programs of studies by courses directing the teaching/learning process at the functional approach. Hence, the suggested in the present discussion approach would rely on giving priority to the development of communicative competence, instead of linguistic. Therefore, in the course of the discussion there appears a suggestion of designing an optimal program of studies in the form of “trivium” based on three pillars: comparative studies, discourse analysis, and translation studies.

Neural Network Action Policy Verification via Predicate Abstraction

Neural networks (NN) are an increasingly important representation of action policies. Verifying that such policies are safe is potentially very hard as it compounds the state space explosion with the difficulty of analyzing even single NN decision episodes. Here we address that challenge through abstract reachability analysis. We show how to compute predicate abstractions of the policy state space subgraph induced by fixing an NN action policy. A key sub-problem here is the computation of abstract state transitions that may be taken by the policy, which as we show can be tackled by connecting to off-the-shelf SMT solvers. We devise a range of algorithmic enhancements, leveraging relaxed tests to avoid costly calls to SMT. We empirically evaluate the resulting machinery on a collection of benchmarks. The results show that our enhancements are required for practicality, and that our approach can outperform two competing approaches based on explicit enumeration and bounded-length verification.

Power IoT System Architecture Integrating Trusted Computing and Blockchain

With the construction of power Internet of Things, the network scale is constantly expanding, the network structure is increasingly complex, and the number of terminals is increasing rapidly, resulting in huge pressure on network security protection, and it is urgent to build a credible operation environment to ensure that the Internet of Things runs safely and reliably. This paper proposes a power Internet of Things architecture combining trusted computing and blockchain. The architecture ensures the credibility and security of the terminal based on remote integrity verification and access control policy verification. A method for malicious node detection based on blockchain (MMNDB) is placed in acquisition layer. It is used to monitor the status of each acquisition devices in time, detect the malicious terminal in time, isolate the suspicious terminal with low credibility from the power Internet of Things, and ensure credibility of the acquisition terminal and the data collected. Under premise of ensuring the communication efficiency of the power communication network, this architecture can greatly ensure the stable working of the power Internet of Things.

Specification and adaptive verification of access control policy for cyber-physical-social spaces

Cyber-Physical-Social Space (CPSS) is a promising paradigm to provide people with an intelligent environment by emphasizing the deep fusion of cyberspace, physical space, and social space. The interdependence of these spaces makes that CPSS is more likely to be attacked. The attack consequences may directly affect the state of the physical world and even endanger the people’s life. Thus, the most challenging issue for CPSS is to ensure the space security. However, existing security analysis methods focus on the static analysis at the design phase. They do not consider the open and dynamic characteristics which are the core features of CPSS. In this paper, we propose an adaptive security analysis framework for CPSS to prevent the unauthorized flow of information. Firstly, the access control model of CPSS is proposed. It controls the access behaviors by considering the space information covering the social, cyber, and physical spaces. Secondly, Labelled Transition System (LTS) is established to describe the future evolutions of CPSS. The space states in the LTS which violate the security requirements are reasoned by the model checking technology. Thirdly, a policy adjustment method is proposed to prevent the system from entering the violated states or mitigate the bad results caused by the violations. In the end, the effectiveness of our approach is evaluated by a smart building case, and the necessity of our approach is analyzed by the performance evaluation.

Securing Workflows Using Microservices and Metagraphs

Companies such as Netflix increasingly use the cloud to deploy their business processes. Those processes often involve partnerships with other companies, and can be modeled as workflows where the owner of the data at risk interacts with contractors to realize a sequence of tasks on the data to be secured. In this paper, we first show how those workflows can be deployed and enforced while preventing data exposure. Second, this paper provides a global framework to enable the verification of workflow policies. Following the principles of zero-trust, we develop an infrastructure using the isolation provided by a microservice architecture to enforce owner policy. We implement a workflow with our infrastructure in a publicly available proof of concept. This work allows us to verify that the specified policy is correctly enforced by testing the deployment for policy violations, and find the overhead cost of authorization to be reasonable for the benefits. In addition, this paper presents a way to verify policies using a suite of tools transforming and checking policies as metagraphs. It is evident from the results that our verification method is very efficient regarding the size of the policies. Overall, this infrastructure and the mechanisms that verify the policy is correctly enforced, and then correctly implemented, help us deploy workflows in the cloud securely.

A Noninterference Model for Mobile OS Information Flow Control and Its Policy Verification

Mobile operating systems such as Android are facing serious security risk. First, they have a large number of users and store a large number of users’ private data, which have become major targets of network attack; second, their openness leads to high security risks; third, their coarse-grained static permission control mechanism leads to a large number of privacy leaks. Recent decentralized information flow control (DIFC) operating systems such as Asbestos, HiStar, and Flume dynamically adjust the label of each process. Asbestos contains inherent covert channels due to this implicit label adjustment. The others close these covert channels through the use of explicit label change, but this impedes communication and increases performance overhead. We present an enhanced implicit label change model (EILCM) for mobile operating systems that can close the known covert channel in these models with implicit label change and supports dynamic constraints on tags for separation of duty. We also formally analyze the reasons why EILCM can close the known covert channels and prove that abstract EILCM systems have the security property of noninterference with declassification by virtue of the model checker tool FDR. We also prove that the problem of EILCM policy verification is NP-complete and propose a backtrack-based search algorithm to solve the problem. Experiments are presented to show that the algorithm is effective.

Rule-based Shielding for Partially Observable Monte-Carlo Planning

Partially Observable Monte-Carlo Planning (POMCP) is a powerful online algorithm able to generate approximate policies for large Partially Observable Markov Decision Processes. The online nature of this method supports scalability by avoiding complete policy representation. The lack of an explicit representation however hinders policy interpretability and makes policy verification very complex. In this work, we propose two contributions. The first is a method for identifying unexpected actions selected by POMCP with respect to expert prior knowledge of the task. The second is a shielding approach that prevents POMCP from selecting unexpected actions. The first method is based on Satisfiability Modulo Theory (SMT). It inspects traces (i.e., sequences of belief-action-observation triplets) generated by POMCP to compute the parameters of logical formulas about policy properties defined by the expert. The second contribution is a module that uses online the logical formulas to identify anomalous actions selected by POMCP and substitute those actions with actions that satisfy the logical formulas fulfilling expert knowledge. We evaluate our approach on Tiger, a standard benchmark for POMDPs, and a real-world problem related to mobile robot navigation. Results show that the shielded POMCP outperforms the standard POMCP in a case study in which a wrong parameter of POMCP makes it select wrong actions from time to time. Moreover, we show that the approach keeps good performance also if the parameters of the logical formula are optimized using trajectories containing some wrong actions.

Specifying and verifying usage control models and policies in TLA$$^+$$

Novel computing paradigms, e.g., the Cloud, introduce new requirements with regard to access control such as utilization of historical information and continuity of decision. However, these concepts may introduce an additional level of complexity to the underpinning model, rendering its definition and verification a cumbersome and prone to errors process. Using a formal language to specify a model and formally verify it may lead to a rigorous definition of the interactions amongst its components, and the provision of formal guarantees for its correctness. In this paper, we consider a case study where we specify a formal model in TLA $$^+$$ for both a policy-neutral and policy-specific UseCON usage control model. Through that, we anticipate to shed light in the analysis and verification of usage control models and policies by sharing our experience when using TLA $$^+$$ specific tools.

Improving the Formal Verification of Reachability Policies in Virtualized Networks

Network Function Virtualization (NFV) and Software Defined Networking (SDN) are new emerging paradigms that changed the rules of networking, shifting the focus on dynamicity and programmability. In this new scenario, a very important and challenging task is to detect anomalies in the data plane, especially with the aid of suitable automated software tools. In particular, this operation must be performed within quite strict times, due to the high dynamism introduced by virtualization. In this article, we propose a new network modeling approach that enhances the performance of formal verification of reachability policies, checked by solving a Satisfiability Modulo Theories (SMT) problem. This performance improvement is motivated by the definition of function models that do not work on single packets, but on packet classes. Nonetheless, the modeling approach is comprehensive not only of stateless functions, but also stateful functions such as NATs and firewalls. The implementation of the proposed approach achieves high scalability in complex networked systems consisting of several heterogeneous functions.

A security policy model transformation and verification approach for software defined networking

Software-defined networking (SDN) has been increasingly utilized to enforce the security of complex networks. However SDN-based security enforcement mechanisms rely heavily on some specific security policies containing underlying network information. Facing the increasingly complex and huge SDN networks, we urgently need a novel security policy management mechanism which can be completely transparent to any underlying network information. That is it can permit network managers to define the high-level security policy model without containing any underlying information, and by means of model transformation, high-level security policy model can be automatically transformed into its corresponding lower-level security policy model containing underlying information. Moreover, we must ensure the system model of data plane updated by the low-level security policy model can hold all of security properties defined in high-level security policy model. Based on these insights, we propose a security policy model transformation and verification approach for SDN in this paper. We first specify the security policies used in SDN networks as a formal security policy model (SPM). Then we establish the system model of SDN’s data plane and the mapping rules between the policy objects of SPM and the system objects of system model of data plane. Based on these mapping rules, we propose a security policy model transformation mechanism which transforms SPM into the low-level security policy model, RSPM. In order to verify the system model of data plane updated by RSPM can hold all of security properties defined in SPM, we propose a security policy verification mechanism based on model checking techniques and a group of validation conditions. Finally, we utilize a comprehensive case to illustrate the feasibility of this approach.

Crop Classification Based on Temporal Signatures of Sentinel-1 Observations over Navarre Province, Spain

Crop classification provides relevant information for crop management, food security assurance and agricultural policy design. The availability of Sentinel-1 image time series, with a very short revisit time and high spatial resolution, has great potential for crop classification in regions with pervasive cloud cover. Dense image time series enable the implementation of supervised crop classification schemes based on the comparison of the time series of the element to classify with the temporal signatures of the considered crops. The main objective of this study is to investigate the performance of a supervised crop classification approach based on crop temporal signatures obtained from Sentinel-1 time series in a challenging case study with a large number of crops and a high heterogeneity in terms of agro-climatic conditions and field sizes. The case study considered a large dataset on the Spanish province of Navarre in the framework of the verification of Common Agricultural Policy (CAP) subsidies. Navarre presents a large agro-climatic diversity with persistent cloud cover areas, and therefore, the technique was implemented both at the provincial and regional scale. In total, 14 crop classes were considered, including different winter crops, summer crops, permanent crops and fallow. Classification results varied depending on the set of input features considered, obtaining Overall Accuracies higher than 70% when the three (VH, VV and VH/VV) channels were used as the input. Crops exhibiting singularities in their temporal signatures were more easily identified, with barley, rice, corn and wheat achieving F1-scores above 75%. The size of fields severely affected classification performance, with ~14% better classification performance for larger fields (>1 ha) in comparison to smaller fields (<0.5 ha). Results improved when agro-climatic diversity was taken into account through regional stratification. It was observed that regions with a higher diversity of crop types, management techniques and a larger proportion of fallow fields obtained lower accuracies. The approach is simple and can be easily implemented operationally to aid CAP inspection procedures or for other purposes.

Drivers of increasing energy consumption in Europe and policy implications

Two years ago, the EU appeared to be well on the way to meeting its 2020 energy efficiency targets. 2014 final energy consumption was lower than in any year since the 1980s and lower than the level required in 2020. Since then, energy consumption has risen in two consecutive years and looks set to have kept on increasing. If these short-term trends continue, the 2020 targets will be missed. In this context, this paper analyses the drivers of recent increases in energy consumption, using index decomposition analysis breaking down changes in an aggregate indicator and assigning the effects to a number of predefined factors. We rely on a decomposition approach that is widely used across Europe and has been developed over more than 20 years as part of the Odyssee-Mure project. The paper also draws upon discussions at an expert workshop organised by the European Commission. The paper does identify areas where energy efficiency policies could be strengthened. We suggest that more ambitious policies are needed to drive improvements in building fabric and space heating efficiency, and that a greater focus on measurement, verification and enforcement of policies would improve the effectiveness of existing policies.