theory PolicySystemSAC

lemma c_reads : "subjectReads SACAuthGraph (partition_label NicC) = {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3}" apply (rule subset_antisym) defer 
    (* backward *)
     apply (rule subsetI) apply (case_tac "x \<in> {partition_label R, partition_label NicA, partition_label NicB, partition_label NicD}") apply (rule c_reads_any_controlled_by_rm, assumption) apply (erule insertE, simp) apply (erule insertE, simp only:, rule c_reads_rm) apply (erule insertE, simp, erule insertE, simp, erule insertE, simp) apply (erule insertE, simp only:, rule c_reads_ep) apply (erule insertE, simp only:, rule c_reads_sc) apply (erule insertE, simp only:, rule reads_lrefl) apply (erule insertE, simp only:, rule reads_ntfn1_via_sc, rule c_reads_sc) apply (erule insertE, simp only:, rule reads_ntfn2_via_rm, rule c_reads_rm) apply (erule insertE, simp only:, rule reads_ntfn3_via_r, rule c_reads_any_controlled_by_rm, simp) apply simp 
    (* forward *)
     apply (rule subsetI) apply (erule subjectReads.induct) by (simp, blast?)+

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. subjectReads SACAuthGraph (partition_label NicC) = {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3} proof (prove)
goal (2 subgoals):
 1. subjectReads SACAuthGraph (partition_label NicC) \<subseteq> {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3}
 2. {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3} \<subseteq> subjectReads SACAuthGraph (partition_label NicC) proof (prove)
goal (2 subgoals):
 1. {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3} \<subseteq> subjectReads SACAuthGraph (partition_label NicC)
 2. subjectReads SACAuthGraph (partition_label NicC) \<subseteq> {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3} proof (prove)
goal (2 subgoals):
 1. {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3} \<subseteq> subjectReads SACAuthGraph (partition_label NicC)
 2. subjectReads SACAuthGraph (partition_label NicC) \<subseteq> {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3} proof (prove)
goal (2 subgoals):
 1. \<And>x. x \<in> {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3} \<Longrightarrow> x \<in> subjectReads SACAuthGraph (partition_label NicC)
 2. subjectReads SACAuthGraph (partition_label NicC) \<subseteq> {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3} proof (prove)
goal (3 subgoals):
 1. \<And>x. \<lbrakk>x \<in> {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3}; x \<in> {partition_label R, partition_label NicA, partition_label NicB, partition_label NicD}\<rbrakk> \<Longrightarrow> x \<in> subjectReads SACAuthGraph (partition_label NicC)
 2. \<And>x. \<lbrakk>x \<in> {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3}; x \<notin> {partition_label R, partition_label NicA, partition_label NicB, partition_label NicD}\<rbrakk> \<Longrightarrow> x \<in> subjectReads SACAuthGraph (partition_label NicC)
 3. subjectReads SACAuthGraph (partition_label NicC) \<subseteq> {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3} proof (prove)
goal (2 subgoals):
 1. \<And>x. \<lbrakk>x \<in> {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3}; x \<notin> {partition_label R, partition_label NicA, partition_label NicB, partition_label NicD}\<rbrakk> \<Longrightarrow> x \<in> subjectReads SACAuthGraph (partition_label NicC)
 2. subjectReads SACAuthGraph (partition_label NicC) \<subseteq> {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3} proof (prove)
goal (2 subgoals):
 1. \<And>x. \<lbrakk>x \<notin> {partition_label R, partition_label NicA, partition_label NicB, partition_label NicD}; x \<in> {partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3}\<rbrakk> \<Longrightarrow> x \<in> subjectReads SACAuthGraph (partition_label NicC)
 2. subjectReads SACAuthGraph (partition_label NicC) \<subseteq> {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3} proof (prove)
goal (2 subgoals):
 1. \<And>x. \<lbrakk>x \<notin> {partition_label R, partition_label NicA, partition_label NicB, partition_label NicD}; x \<in> {partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3}\<rbrakk> \<Longrightarrow> x \<in> subjectReads SACAuthGraph (partition_label NicC)
 2. subjectReads SACAuthGraph (partition_label NicC) \<subseteq> {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3} proof (prove)
goal (2 subgoals):
 1. \<And>x. \<lbrakk>x \<notin> {partition_label R, partition_label NicA, partition_label NicB, partition_label NicD}; x \<in> {partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3}\<rbrakk> \<Longrightarrow> x \<in> subjectReads SACAuthGraph (partition_label NicC)
 2. subjectReads SACAuthGraph (partition_label NicC) \<subseteq> {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3} proof (prove)
goal (2 subgoals):
 1. \<And>x. \<lbrakk>x \<notin> {partition_label R, partition_label NicA, partition_label NicB, partition_label NicD}; x \<in> {partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3}\<rbrakk> \<Longrightarrow> x \<in> subjectReads SACAuthGraph (partition_label NicC)
 2. subjectReads SACAuthGraph (partition_label NicC) \<subseteq> {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3} proof (prove)
goal (2 subgoals):
 1. \<And>x. \<lbrakk>x \<notin> {partition_label R, partition_label NicA, partition_label NicB, partition_label NicD}; x \<in> {partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3}\<rbrakk> \<Longrightarrow> x \<in> subjectReads SACAuthGraph (partition_label NicC)
 2. subjectReads SACAuthGraph (partition_label NicC) \<subseteq> {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3} proof (prove)
goal (2 subgoals):
 1. \<And>x. \<lbrakk>x \<notin> {partition_label R, partition_label NicA, partition_label NicB, partition_label NicD}; x \<in> {partition_label NTFN1, partition_label NTFN2, partition_label NTFN3}\<rbrakk> \<Longrightarrow> x \<in> subjectReads SACAuthGraph (partition_label NicC)
 2. subjectReads SACAuthGraph (partition_label NicC) \<subseteq> {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3} proof (prove)
goal (2 subgoals):
 1. \<And>x. \<lbrakk>x \<notin> {partition_label R, partition_label NicA, partition_label NicB, partition_label NicD}; x \<in> {partition_label NTFN2, partition_label NTFN3}\<rbrakk> \<Longrightarrow> x \<in> subjectReads SACAuthGraph (partition_label NicC)
 2. subjectReads SACAuthGraph (partition_label NicC) \<subseteq> {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3} proof (prove)
goal (2 subgoals):
 1. \<And>x. \<lbrakk>x \<notin> {partition_label R, partition_label NicA, partition_label NicB, partition_label NicD}; x \<in> {partition_label NTFN3}\<rbrakk> \<Longrightarrow> x \<in> subjectReads SACAuthGraph (partition_label NicC)
 2. subjectReads SACAuthGraph (partition_label NicC) \<subseteq> {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3} proof (prove)
goal (2 subgoals):
 1. \<And>x. \<lbrakk>x \<notin> {partition_label R, partition_label NicA, partition_label NicB, partition_label NicD}; x \<in> {}\<rbrakk> \<Longrightarrow> x \<in> subjectReads SACAuthGraph (partition_label NicC)
 2. subjectReads SACAuthGraph (partition_label NicC) \<subseteq> {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3} proof (prove)
goal (1 subgoal):
 1. subjectReads SACAuthGraph (partition_label NicC) \<subseteq> {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3} proof (prove)
goal (1 subgoal):
 1. subjectReads SACAuthGraph (partition_label NicC) \<subseteq> {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3} proof (prove)
goal (1 subgoal):
 1. \<And>x. x \<in> subjectReads SACAuthGraph (partition_label NicC) \<Longrightarrow> x \<in> {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3} proof (prove)
goal (13 subgoals):
 1. \<And>x l'. (partition_label NicC, Read, l') \<in> SACAuthGraph \<Longrightarrow> l' \<in> {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3}
 2. \<And>x. partition_label NicC \<in> {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3}
 3. \<And>x auth ep. \<lbrakk>(partition_label NicC, auth, ep) \<in> SACAuthGraph; auth \<in> {SyncSend, Receive}\<rbrakk> \<Longrightarrow> ep \<in> {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3}
 4. \<And>x a auth' ep t auth. \<lbrakk>(a, auth', ep) \<in> SACAuthGraph; auth' \<in> {Notify, SyncSend, Reset}; (t, auth, ep) \<in> SACAuthGraph; auth \<in> {SyncSend, Receive}; t \<in> subjectReads SACAuthGraph (partition_label NicC); t \<in> {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3}\<rbrakk> \<Longrightarrow> ep \<in> {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3}
 5. \<And>x b t. \<lbrakk>b \<in> subjectReads SACAuthGraph (partition_label NicC); b \<in> {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3}; (t, Write, b) \<in> SACAuthGraph\<rbrakk> \<Longrightarrow> t \<in> {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3}
 6. \<And>x t p. \<lbrakk>t \<in> subjectReads SACAuthGraph (partition_label NicC); t \<in> {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3}; (t, Read, p) \<in> SACAuthGraph\<rbrakk> \<Longrightarrow> p \<in> {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3}
 7. \<And>x ep b. \<lbrakk>ep \<in> subjectReads SACAuthGraph (partition_label NicC); ep \<in> {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3}; (b, SyncSend, ep) \<in> SACAuthGraph\<rbrakk> \<Longrightarrow> b \<in> {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3}
 8. \<And>x ep b. \<lbrakk>ep \<in> subjectReads SACAuthGraph (partition_label NicC); ep \<in> {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3}; (b, Call, ep) \<in> SACAuthGraph\<rbrakk> \<Longrightarrow> b \<in> {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3}
 9. \<And>x ep b. \<lbrakk>ep \<in> subjectReads SACAuthGraph (partition_label NicC); ep \<in> {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3}; (b, Receive, ep) \<in> SACAuthGraph\<rbrakk> \<Longrightarrow> b \<in> {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3}
 10. \<And>x t' t. \<lbrakk>t' \<in> subjectReads SACAuthGraph (partition_label NicC); t' \<in> {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3}; (t, Reply, t') \<in> SACAuthGraph\<rbrakk> \<Longrightarrow> t \<in> {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3}
A total of 13 subgoals...