November 7-11, 2005 IWFST2005 1

A formal specification of entrance system using contactless IC card

Tatsuo SUMIDA, Yoichi OMORI, and Keijiro ARAKIGraduate School of Information Science and Electrical Engineering,

Kyushu Universitysumida@ale.csce.kyushu-u.ac.jp

November 7-11, 2005 IWFST2005 2

Introduction• Background

– Contactless IC card which began prevailing as a new technology has many features different from existing technologies such as magnetic card

– One of problems that contactless IC card have is data consistency problem that writing data rarely breaks if communicating with reader/writer becomes impossible while communicating

– The interruption is caused by various reasons, such as out of range, existence of metal, etc.

• The purpose of this research– We specify strictly the characters of contactless IC card by formal

method and classify the reasons of discrepancy to dissolve them in advance

November 7-11, 2005 IWFST2005 3

Approach for the purpose of this research

• Modeling with UML– UML can specify roughly the

system using contactless IC card with diagrammatic expression

– But it will not be easy to describe the details of it

• Modeling with VDM– VDM can specify strictly

contactless IC card with mathematical expression

– But it will not be easy to understand it intuitively

• By mixing UML and VDM– We can model the system using

contactless IC card that makes the best use of the merit of two methods and supplements the weak point each other

Modeling with UML

Modeling with VDM

Implementation and Examination

The entry control system at library

November 7-11, 2005 IWFST2005 4

Modeling with UML

November 7-11, 2005 IWFST2005 5

Modeling with VDMclass CCard instance variables m_doc : Data_Of_Card; m_ps : Power_Supply; m_m : Mode;

operations public write(rw:CReaderWriter, idm:ID_Manufacture, ntd:inmap

Name_Of_Service to Data_Of_Service) r:bool ext wr m_doc : Data_Of_Card rd m_ps : Power_Supply rd m_m : Mode pre pre_(authentication, rw, idm, dom(ntd)) and m_m = <AUTHENTICATED> post m_doc.ntd = m_doc~.ntd ++ ntd and if (canCommunication(rw)) then r = true else r = false errs Power_Suppy_Interrupted : m_ps = <OFF> -> r = false;

private existTimeInRangeOfCommunication() r:bool ext rd m_ps : Power_Supply rd m_t : CTime wr m_et : [CTime`Time]

rd m_s : CSpace post let rws = dom(m_s.getReaderWriter()) in ( if (exists rw in set rws & canCommunication(rw)) then ( if (m_et = nil) then m_et = m_t.getTime() else r = (m_t.getTime() - m_et >=

TIME_FOR_COMMUNICATION) ) else ( m_et = nil and r = false ) );

private canCommunication(rw:CReaderWriter) r:bool post r = (existInRangeOfCommunication(rw) and correctDirection(rw) and not existObstacleInSurroundings(rw));

thread while true do checkPowerSuppy()

end CCard

November 7-11, 2005 IWFST2005 6

In conclusion

• Summary of this research– It became easy to understand the cause that

communication between contactless IC card and reader/writer becomes impossible by describing hierarchically it

– As a result, it is thought that specific of the cause becomes easy if data consistency problem happens