theory PolicySystemSAC

lemma ep_reads : "subjectReads SACAuthGraph (partition_label EP) = {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3}" apply (rule subset_antisym) defer 
  (* backward *)
   apply (rule subsetI) apply (erule insertE, rule reads_all_rm_controlled_subjects, rule ep_reads_rm, simp) apply (erule insertE, simp only:, rule ep_reads_rm) apply (erule insertE, rule reads_all_rm_controlled_subjects, rule ep_reads_rm, simp) apply (erule insertE, rule reads_all_rm_controlled_subjects, rule ep_reads_rm, simp) apply (erule insertE, rule reads_all_rm_controlled_subjects, rule ep_reads_rm, simp) apply (erule insertE, simp only:, rule reads_lrefl) apply (erule insertE, simp only:, rule ep_reads_sc) apply (erule insertE, simp only:, rule ep_reads_c) apply (erule insertE, simp only:, rule reads_ntfn1_via_sc, rule ep_reads_sc) apply (erule insertE, simp only:, rule reads_ntfn2_via_rm, rule ep_reads_rm) apply (erule insertE, simp only:, rule reads_ntfn3_via_r, rule reads_all_rm_controlled_subjects, rule ep_reads_rm, simp) apply simp 
  (* forward *)
   apply (rule subsetI) apply (erule subjectReads.induct) apply (simp, blast?)+ done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. subjectReads SACAuthGraph (partition_label EP) = {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3} proof (prove)
goal (2 subgoals):
 1. subjectReads SACAuthGraph (partition_label EP) \<subseteq> {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3}
 2. {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3} \<subseteq> subjectReads SACAuthGraph (partition_label EP) proof (prove)
goal (2 subgoals):
 1. {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3} \<subseteq> subjectReads SACAuthGraph (partition_label EP)
 2. subjectReads SACAuthGraph (partition_label EP) \<subseteq> {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3} proof (prove)
goal (2 subgoals):
 1. {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3} \<subseteq> subjectReads SACAuthGraph (partition_label EP)
 2. subjectReads SACAuthGraph (partition_label EP) \<subseteq> {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3} proof (prove)
goal (2 subgoals):
 1. \<And>x. x \<in> {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3} \<Longrightarrow> x \<in> subjectReads SACAuthGraph (partition_label EP)
 2. subjectReads SACAuthGraph (partition_label EP) \<subseteq> {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3} proof (prove)
goal (2 subgoals):
 1. \<And>x. x \<in> {partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3} \<Longrightarrow> x \<in> subjectReads SACAuthGraph (partition_label EP)
 2. subjectReads SACAuthGraph (partition_label EP) \<subseteq> {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3} proof (prove)
goal (2 subgoals):
 1. \<And>x. x \<in> {partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3} \<Longrightarrow> x \<in> subjectReads SACAuthGraph (partition_label EP)
 2. subjectReads SACAuthGraph (partition_label EP) \<subseteq> {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3} proof (prove)
goal (2 subgoals):
 1. \<And>x. x \<in> {partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3} \<Longrightarrow> x \<in> subjectReads SACAuthGraph (partition_label EP)
 2. subjectReads SACAuthGraph (partition_label EP) \<subseteq> {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3} proof (prove)
goal (2 subgoals):
 1. \<And>x. x \<in> {partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3} \<Longrightarrow> x \<in> subjectReads SACAuthGraph (partition_label EP)
 2. subjectReads SACAuthGraph (partition_label EP) \<subseteq> {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3} proof (prove)
goal (2 subgoals):
 1. \<And>x. x \<in> {partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3} \<Longrightarrow> x \<in> subjectReads SACAuthGraph (partition_label EP)
 2. subjectReads SACAuthGraph (partition_label EP) \<subseteq> {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3} proof (prove)
goal (2 subgoals):
 1. \<And>x. x \<in> {partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3} \<Longrightarrow> x \<in> subjectReads SACAuthGraph (partition_label EP)
 2. subjectReads SACAuthGraph (partition_label EP) \<subseteq> {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3} proof (prove)
goal (2 subgoals):
 1. \<And>x. x \<in> {partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3} \<Longrightarrow> x \<in> subjectReads SACAuthGraph (partition_label EP)
 2. subjectReads SACAuthGraph (partition_label EP) \<subseteq> {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3} proof (prove)
goal (2 subgoals):
 1. \<And>x. x \<in> {partition_label NTFN1, partition_label NTFN2, partition_label NTFN3} \<Longrightarrow> x \<in> subjectReads SACAuthGraph (partition_label EP)
 2. subjectReads SACAuthGraph (partition_label EP) \<subseteq> {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3} proof (prove)
goal (2 subgoals):
 1. \<And>x. x \<in> {partition_label NTFN2, partition_label NTFN3} \<Longrightarrow> x \<in> subjectReads SACAuthGraph (partition_label EP)
 2. subjectReads SACAuthGraph (partition_label EP) \<subseteq> {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3} proof (prove)
goal (2 subgoals):
 1. \<And>x. x \<in> {partition_label NTFN3} \<Longrightarrow> x \<in> subjectReads SACAuthGraph (partition_label EP)
 2. subjectReads SACAuthGraph (partition_label EP) \<subseteq> {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3} proof (prove)
goal (2 subgoals):
 1. \<And>x. x \<in> {} \<Longrightarrow> x \<in> subjectReads SACAuthGraph (partition_label EP)
 2. subjectReads SACAuthGraph (partition_label EP) \<subseteq> {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3} proof (prove)
goal (1 subgoal):
 1. subjectReads SACAuthGraph (partition_label EP) \<subseteq> {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3} proof (prove)
goal (1 subgoal):
 1. subjectReads SACAuthGraph (partition_label EP) \<subseteq> {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3} proof (prove)
goal (1 subgoal):
 1. \<And>x. x \<in> subjectReads SACAuthGraph (partition_label EP) \<Longrightarrow> x \<in> {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3} proof (prove)
goal (13 subgoals):
 1. \<And>x l'. (partition_label EP, Read, l') \<in> SACAuthGraph \<Longrightarrow> l' \<in> {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3}
 2. \<And>x. partition_label EP \<in> {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3}
 3. \<And>x auth ep. \<lbrakk>(partition_label EP, auth, ep) \<in> SACAuthGraph; auth \<in> {SyncSend, Receive}\<rbrakk> \<Longrightarrow> ep \<in> {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3}
 4. \<And>x a auth' ep t auth. \<lbrakk>(a, auth', ep) \<in> SACAuthGraph; auth' \<in> {Notify, SyncSend, Reset}; (t, auth, ep) \<in> SACAuthGraph; auth \<in> {SyncSend, Receive}; t \<in> subjectReads SACAuthGraph (partition_label EP); t \<in> {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3}\<rbrakk> \<Longrightarrow> ep \<in> {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3}
 5. \<And>x b t. \<lbrakk>b \<in> subjectReads SACAuthGraph (partition_label EP); b \<in> {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3}; (t, Write, b) \<in> SACAuthGraph\<rbrakk> \<Longrightarrow> t \<in> {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3}
 6. \<And>x t p. \<lbrakk>t \<in> subjectReads SACAuthGraph (partition_label EP); t \<in> {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3}; (t, Read, p) \<in> SACAuthGraph\<rbrakk> \<Longrightarrow> p \<in> {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3}
 7. \<And>x ep b. \<lbrakk>ep \<in> subjectReads SACAuthGraph (partition_label EP); ep \<in> {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3}; (b, SyncSend, ep) \<in> SACAuthGraph\<rbrakk> \<Longrightarrow> b \<in> {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3}
 8. \<And>x ep b. \<lbrakk>ep \<in> subjectReads SACAuthGraph (partition_label EP); ep \<in> {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3}; (b, Call, ep) \<in> SACAuthGraph\<rbrakk> \<Longrightarrow> b \<in> {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3}
 9. \<And>x ep b. \<lbrakk>ep \<in> subjectReads SACAuthGraph (partition_label EP); ep \<in> {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3}; (b, Receive, ep) \<in> SACAuthGraph\<rbrakk> \<Longrightarrow> b \<in> {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3}
 10. \<And>x t' t. \<lbrakk>t' \<in> subjectReads SACAuthGraph (partition_label EP); t' \<in> {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3}; (t, Reply, t') \<in> SACAuthGraph\<rbrakk> \<Longrightarrow> t \<in> {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3}
A total of 13 subgoals... proof (prove)
goal:
No subgoals!