\chapter{Basis sets}\label{chap:basisets}

%\section{Introduction}
\abstract{Numerical integration and differentiation
are some of the most frequently needed methods in computational
physics. Quite often we are confronted with the need of evaluating
either the derivative $f'$ or an integral  $\int f(x)dx$.
The aim of this chapter is to introduce some of these methods
with a critical eye on numerical accuracy, following the discussion
in the previous chapter.
 The next section deals essentially with topics from numerical differentiation.
There we present also the most commonly used formulae for computing
first and second derivatives, formulae which in turn find their most important
applications in the numerical solution of ordinary and partial
differential equations. We discuss also selected methods for numerical
interpolation.
This  chapter serves also the scope of introducing
some more advanced C++ programming concepts, such as call
by reference and value, reading and writing to a file and the use
of dynamic memory allocation.  We will also discuss several object-oriented features of C++,
ending the chapter with an analogous discussion of Fortran features.}

In the previous chapter the general Hartree-Fock equations, which is a set of
integro-differential equations, were converted to a set of algebraic equations (the Roothaan
equations in the restricted case and the Pople-Nesbet equations in the unrestricted case) by
expanding the unknown orbitals in a known set of basis functions. The Fock operator was then
reduced to a matrix, the elements of which are integrals involving the chosen basis functions.

We start this chapter by discussing two popular types of basis functions, namely the
Slater-type orbtials (STOs) and the Gaussian-type orbitals (GTOs). The latter is more suited for
molecular calculations and is the one we will use in this thesis. Thereafter we derive the
integration scheme for the Gaussian type orbitals.

\section{Basis functions}
For a molecular system, the eigenfunctions of the Hartree-Fock equations are called
\emph{molecular orbitals} (MOs). As discussed earlier, it is important to distinguish these
from the perhaps more familiar \emph{atomic orbitals}, and it is erroneous to
think that the electrons of molecular systems are occupying atomic orbitals.
Consider for example the $H_2$-molecule.
In the ground state the electrons are not occupying the 1$s$-orbitals of atomic hydrogen. The
molecular system is entirely different from the atomic one, with an entirely different Hamiltonian,
and the eigenstates of the Hartree-Fock equations will therefore also be different.

In order to solve the Hartree-Fock equations, we need to expand the molecular orbitals in a known
set of basis functions
\begin{equation}
 \phi_k(\vec r) = \sum_{\mu=1}^M\chi_{\mu k}(\vec r).
\end{equation}
The importance of choosing suitable basis functions can hardly be overemphasised; it completely determines
the accuracy of the results as well as the computational cost of the calculations. In choosing basis functions,
the following criteria should be met:
\begin{enumerate}
 \item The functions must be physically reasonable, i.e., they should have large probability where
      the electrons are likely to be and small probability elsewhere.
 \item It should be possible to integrate the functions efficiently.
 \item The solution of the Hartree-Fock equations must converge towards the Hartree-Fock limit (see chapter \ref{chapter:electron_correlation})
       as the number of basis functions increases.
\end{enumerate}
The first point suggests that we choose atomic orbitals as basis functions,  which is often
referred to as ``linear combination of atomic orbitals'' (LCAO). In this thesis we will let the
atomic orbitals be centered at the nuclei. However, this is not strictly required since the
atomic orbitals are merely being used as basis functions, and they are not to be thought of
as orbitals occupied by electrons. In the following two subsections, we
discuss two common types of atomic orbitals, namely the Slater type orbitals (STOs) and
Gaussian type orbitals (GTOs), respectively. Only the GTOs will be applied to the
calculations in this thesis.

\subsection{Slater-type orbitals (STOs)}
The Slater type orbitals are defined as \cite{Cramer}
\begin{equation}
 \chi^{STO}(r,\theta,\phi,n,l,m) = \frac{(2a)^{n+1/2}}{[(2n)!]^{1/2}}r^{n-1}\exp(-a r) Y^m_l(\theta,\phi),
\end{equation}
where $n$ is the principal quantum number, $l$ and $m$ are the angular momentum quantum numbers,
$Y^m_l(\theta,\phi)$ are the spherical harmonics familiar from the solution of the Schrödinger
equation for the hydrogen atom, and $a$ is an exponent which determines the radial decay of the
function. The main attractive features of the STOs are that they have the correct exponential decay with
increasing $r$ and that the angular components are hydrogenic. For this reason, they are often
used in atomic Hartree-Fock calculations. When doing molecular calculations, however, they have the
disadvantage that the two-particle integrals $\bra{\mu\sigma}g\ket{\nu\lambda}$ occuring in the
Fock matrix $F_{\mu\nu}$ have no known analytical expression. This is because integrals of products
of exponentials centered on different nuclei are difficult to handle. They can of course be calculated
numerically, but for large molecules this is very time consuming.

\subsection{Gaussian-type orbitals (GTOs)}
A clever trick which makes multiple center integrals easier to handle is to replace the exponential
term $\exp(-a r)$ with $\exp(-a r^2)$, i.e., to use Gaussian functions. This greatly simplifies the
integrals because the product of two Gaussians centered on nuclei with positions
$\vec A$ and $\vec B$ is equal to \emph{one} Gaussian centered on some point $\vec P$ on
the line between them:
\begin{equation}
\label{eq:gaussian_product}
 \exp(-a|\vec r - \vec A|^2)\cdot \exp(-b|\vec r - \vec B|^2) = K_{AB}\,\exp(-p|\vec r - \vec P|^2),
\end{equation}
where
\begin{eqnarray}
 K_{AB} & = & \exp\Big(-\frac{ab}{a + b}|\vec A - \vec B|^2\Big), \\
 \vec P & = & \frac{a \vec A + b \vec B}{a + b}, \\
 p & = & a + b.
\end{eqnarray}
This is the so-called \emph{Gaussian product theorem}. It is illustrated in the one-dimensional case in figure \ref{fig:Gaussians}.
\begin{figure}
 \begin{center}
  \includegraphics[scale=0.5]{basis_functions_and_integral_evaluation/figures/Gaussians.pdf}
  \caption{Illustration of the Gaussian product theorem which says that the product of two Gaussians with centers at points A and B is another Gaussian
           with center somewhere between A and B.}
  \label{fig:Gaussians}
 \end{center}
\end{figure}

The general functional form of a normalised Gaussian type orbital
centered at $\vec A$ is given by \cite{Cramer}
\begin{equation}
\label{eq:gaussian_primitive}
 G_{ijk}(a, \vec r_A) = \Big(\frac{2a}{\pi}\Big)^{3/4}\Big[\frac{(8a)^{i+j+k}\,i!\,j!\,k!}{(2i)!\,(2j)!\,(2k)!}\Big]x_A^i\,y_A^j\,z_A^k\,\exp(-a r_A^2),
\end{equation}
where $\vec r_A = \vec r - \vec A$ and the integers $i$, $j$, $k$ determine the angular momentum quantum number $l=i+j+k$.

\subsection{Contracted GTOs}
\label{subsec:contracted_gtos}
The greatest drawback with Gaussians is that they do not have the proper exponential radial decay. This can be remedied by forming linear combinations of GTOs
to resemble the STOs
\begin{equation}
 \chi^{CGTO}(\vec r_A,i,j,k) = \sum_{p=1}^L d_p G_{ijk}(a_p, \vec r_A).
\end{equation}
These are called STO-LG basis functions, where L refers to the number of Gaussians used in the linear combination. Hehre, Stewart and Pople \cite{pople}
were the first to systematically calculate optimal coefficients $d_p$ and exponentials $a_p$, and today the STO-LG basis sets are available
for most atoms.
The individual Gaussians are called \emph{primitive} basis functions and the linear combinations are called \emph{contracted} basis functions, hence the label
CGTO (Contracted Gaussian Type Orbital). In this thesis we will only consider CGTOs, and whenever the symbol $\chi$ appears without any label,
we will always mean CGTO.

A very common choice for the STO-LG basis sets is $L=3$. Figure \ref{fig:STOvsSTO3G} shows how the 1$s$ STO for hydrogen is approximated by 3 GTOs.
The exponents $a_p$ and coefficients $d_p$ have been set so that the contracted basis function lies as close to the STO as possible, see
table \ref{tab:STO3G}. It is important to note that the parameters $(a_p,d_p)$ are static and that the linear combination of Gaussians constitute \emph{one single}
basis function. Throughout this text the phrase ``basis function'' will always refer to a contracted basis function.

\begin{figure}
 \begin{center}
  \includegraphics[scale=0.7]{basis_functions_and_integral_evaluation/figures/STO3G.pdf}
  \caption{The whole line shows the 1s STO basis function, while the broken line shows a linear combination of three Gaussians.}
  \label{fig:STOvsSTO3G}
 \end{center}
\end{figure}

% Note that the GTOs and STOs do not have any radial nodes as the hydrogenic functions do. This means that no single GTO or STO can mimic the 2$s$ hydrogenic orbital for example. With contractions, however,
% this problem is eliminated; nodes can be introduced by using a combination of positive and negative coefficients $d_p$.

The STO-LG basis sets belong to the family of \emph{minimal basis sets}.
It means that there is one and only one basis function per atomic orbital.
The STO-LG basis sets for the hydrogen and helium atoms, for example, contain only one basis
function for the 1$s$ atomic orbital. This basis function is, as explained above, composed of
a linear combination of L primitives. For the atoms lithium through neon the STO-LG basis
sets contain 5 basis functions; one for each of the atomic orbitals
$1s$, $2s$, $2p_x$, $2p_y$ and $2p_z$.

\begin{table}
 \begin{center}
 \caption{Coefficients and exponents used in the STO-3G basis shown in figure \ref{fig:STOvsSTO3G}.}
 \label{tab:STO3G}
  \begin{tabular}{|c|c|c|c|}\hline
   $p$        &  1  &  2  &   3 \\ \hline
   $d_p$      &  0.1543   & 0.5353    & 0.4446  \\ \hline
   $a_p$ &  3.4252   & 0.6239    & 0.1688  \\ \hline
  \end{tabular}
 \end{center}
\end{table}

The reader might be asking herself why the coefficients $d_p$ in the linear combination of the STO-LGs are static. Shouldn't the accuracy of our results
actually improve if we let the coefficients vary? The answer to this is yes. However, the linear system to be solved (the Hartree-Fock equations) will then
be larger. Thus there is a trade off between accuracy and computational efficiency which must be considered.

However, basis sets where the STO-LG sets have been ``decontracted'' as described above have actually been used. They belong to the family of $\zeta$-basis sets.
The double-$\zeta$ and triple-$\zeta$ basis sets have two and three basis functions, respectively, for each atomic orbital. As an example, we could
create a double-$\zeta$ basis set from the STO-3G basis set by contracting the two first primitives and leave the third as a normalised primitive. Similarly, we could
counstruct a triple-$\zeta$ basis set by treating each primitive as a basis function.

Let us for a moment assume that we use a triple-$\zeta$ basis set constructed from the STO-3G to do Hartree-Fock calculations on atomic oxygen.
What will the resulting orbitals look like? The lowest orbital will be very close to the definition of the 1$s$ orbital of the STO-3G set.
This is to be expected since the STO-3G basis functions are constructed to resemble the STO atomic orbitals.

What if we now apply the same triple-$\zeta$ basis to calculations on the CO molecule, say? In this case we would probably also find an orbital which resembles the 1$s$
orbital of the STO-3G basis for oxygen. This is because it is mostly the valence electrons which contribute in the bonding between atoms, and the core electrons are more or less unaffected.
Thus decontracting basis functions corresponding to the core atomic orbitals will generally not pay off, but will merely increase the computational load. Therefore, basis
sets have been constructed where only the functions corresponding to the valence atomic orbitals are decontracted. These are the so-called \emph{split-valence} basis sets.
An example of a split-valence basis set is the 3-21G. The number before the hyphen (in this case 3) is the number of primitives per core atomic orbital. The fact that there are
two numbers after the hyphen signifies that there are two basis functions for each valence atomic orbital. The numbers themselves (in this case 2 and 1) indicate how many primitives
the first and second of these are composed of. As an example, the 3-21G basis set for the oxygen atom has one single
basis function for the 1$s$ orbital (since this is the core orbital), and this basis function consists of three primitives. Furthermore, it has two basis functions for the 2$s$,
2$p_x$, 2$p_y$ and 2$p_z$ atomic orbitals (since these are the valence orbitals). The first consists of two primitives, and the second consists of only one
primitive. In sum the oxygen atom thus has 9 basis functions which are built up from a total of 15 primitives.
Other examples of split-valence basis sets are 4-31G, 6-31G and 6-311G \cite{Cramer}.

In many molecular calculations, the split-valence basis sets mentioned thus far do not provide enough flexibility to describe the chemistry appropriately.
This is often fixed by adding functions
corresponding to atomic orbitals with angular momentum $l_{max}+1$, where $l_{max}$ is the highest angular momentum of the atom.
Such functions are called \emph{polarisation functions}. For example, the polarisation functions for the Oxygen atom are the $d$-functions. Asterisks (*) are added to the name of the basis set to indicate that polarisation
functions are included. One asterisk (as in 6-31G*) indicates that $d$-functions are added to polarise the $p$-functions of first row atoms (Li-Ne). Two asterisks (as in 6-31G**)
mean that $p$-functions are added to polarise the $s$-functions of hydrogen and helium as well.

% Note that the 3-21G basis set for Oxygen contains basis functions for each atomic orbital up to the $p$-orbital. Similarly, all the split-valence basis sets mentioned above
% contain basis functions for each atomic orbital up to the the highest present in the atom which is considered. However, in many molecular calculations this does not provide enough flexibility to
% describe the chemistry correctly. One way to increase the flexibility is to include basis functions for the orbital \emph{above} the highest present in the atom. These functions
% are called \emph{polarization functions}. The polarization functions for the Oxygen atom are the $d$-orbitals. An asterix (*) is added to the name of the basis set to indicate that polarization
% functions are included. One asterisk (as in 3-21G*, for example) indicate that $d$-functions are added to polarize the $p$-functions. Two asterisks (as in 3-21G**, for example)
% are added to show that also the $s$-functions of Hydrogen and helium are polarized by $p$-functions.

It should be noted that the list of basis sets mentioned here is in no way exhaustive. There is a flora of basis sets out there, see for example
Cramer \cite{Cramer} or Helgaker \emph{et al} \cite{Helgaker}.

\section{Integral evaluation}
As discussed in the previous section, using Gaussian basis functions significantly improves the speed of the integrations which must be done when setting up the Fock matrix.
This section discusses the details of how the integration is performed.

We start by summarising the most important properties of the Cartesian Gaussians. Thereafter, we
change basis to the so-called Hermite Gaussians, as proposed by \v{Z}ivkovi\'{c} and Maksi\'{c} \cite{zivkovic_maksic}.
Then, following the work of McMurchie and Davidson \cite{mcmurchie_davidson}, we show how the one- and two-particle integrals can be expressed compactly in
terms of some auxiliary functions. The auxiliary functions are computed via a set of recurrence relations.

A thorough review of the techniques presented can be found in Helgaker \emph{et al} \cite{Helgaker}.

\subsection{Cartesian Gaussians}
The Cartesian Gaussian functions centered at $\vec A$ are given by
\begin{equation}
 G_{ijk}(a, \vec r_A) = x^i_A\,y^j_A\,z^k_A\,\exp(-a r^2_A),
\end{equation}
where $\vec r_A = \vec r - \vec A$. These will be our primitive basis functions. They factorise in the Cartesian components
\begin{equation}
 G_{ijk}(a, \vec r_A) = G_i(a, x_A)\,G_j(a, y_A)\,G_k(a, z_A),
\end{equation}
where
\begin{equation}
 G_i(a, x_A) = x^i_A\,\exp(-a x^2_A),
\end{equation}
and the other factors are defined similarly. Each of the components obey the simple recurrence relation
\begin{equation}
 x_A\,G_i = G_{i+1}.
\end{equation}

\subsection{Gaussian overlap distribution}
We introduce the following shorthand notation
\begin{align}
  G_a(\vec r) & = G_{ikm}(a, \vec r_A), \label{eq:Ga}\\
  G_b(\vec r) & = G_{jln}(b, \vec r_B), \label{eq:Gb}
\end{align}
and define the overlap distribution
\begin{equation}
 \Omega_{ab}(\vec r) = G_a(\vec r)\,G_b(\vec r).
\end{equation}
Using the Gaussian product theorem (\ref{eq:gaussian_product}) this can be written as
\begin{equation}
 \Omega_{ab}(\vec r) = K_{AB}\,x^i_A\,x^j_B\,y^k_A\,y^l_B\,z^m_A\,z^n_B\,\exp(-p\,r^2_P),
\end{equation}
where
\begin{equation}
\label{eq:gaussian_product_defs}
 \begin{split}
  K_{AB} & = \exp\Big(-\frac{ab}{a + b}R^2_{AB}\Big) \\
  \vec R_{AB} & =  \vec A - \vec B \\
  p & = a + b\\
  \vec r_P & = \vec r - \vec P \\
  \vec P & = \frac{a\vec A + b\vec B}{a + b}.
 \end{split}
\end{equation}
Because the Gaussians $G_a$ and $G_b$ factorise in their Cartesian components, so does the overlap distribution
\begin{equation}
 \Omega_{ab}(\vec r) = \Omega_{ij}(x)\,\Omega_{kl}(y)\,\Omega_{mn}(z),
\end{equation}
where
\begin{equation}
 \Omega_{ij} = K^x_{AB}\,x^i_A\,x^j_B\,\exp(-px^2_P)
\end{equation}
and
\begin{equation}
\begin{split}
 K^x_{AB} = & \exp\Big(-\frac{ab}{a + b}X^2_{AB}\Big) \\
   X_{AB} = & A_x - B_x.
\end{split}
\end{equation}
The distributions $\Omega_{kl}(y)$ and $\Omega_{mn}(z)$ are defined similarly.

\subsection{Hermite Gaussians}
Later we will expand the Cartesian Gaussians in terms of the so-called Hermite Gaussians.
This will simplify the integrations significantly. The Hermite Gaussians centered at $\vec P$ are defined by
\begin{equation}
 \Lambda_{tuv}(p, \vec r_p) = \Big(\frac{\partial}{\partial P_x}\Big)^t \Big(\frac{\partial}{\partial P_y}\Big)^u \Big(\frac{\partial}{\partial P_z}\Big)^v \exp(-p\, r^2_P),
\end{equation}
where $\vec r_p = \vec r - \vec P$. They factorise in the same way as the Cartesian Gaussians do:
\begin{equation}
 \Lambda_{tuv}(p, \vec r_P) = \Lambda_t(p,x_P)\,\Lambda_u(p,y_P)\,\Lambda_v(p,z_P),
\end{equation}
where
\begin{equation}
\label{eq:HermiteGaussian_x}
 \Lambda_t(p,x_P) = \Big(\frac{\partial}{\partial P_x}\Big)^t \exp(-p\,x^2_P),
\end{equation}
and the other factors are defined similarly. However, their recurrence relation is quite different from that of the Cartesian Gaussians:
\begin{equation}
\begin{split}
 \Lambda_{t+1}(p,x_P) & = \Big(\frac{\partial}{\partial P_x}\Big)^t \frac{\partial}{\partial P_x}\exp(-px^2_P) \\
                      & = \Big(\frac{\partial}{\partial P_x}\Big)^t 2px_P \exp(-px^2_P)  \\
                      & = 2p[-t\Big(\frac{\partial}{\partial P_x}\Big)^{t-1} + x_P \Big(\frac{\partial}{\partial P_x}\Big)^t] \exp(-px^2_P) \\
                      & = 2p[-t\Lambda_{t-1} + x_P \Lambda_t],
\end{split}
\end{equation}
where we have used that
\begin{equation}
\label{eq:derivation_rule}
 \Big(\frac{\partial}{\partial x}\Big)^t x f(x) = t\Big(\frac{\partial}{\partial x}\Big)^{t-1}f(x) + x\Big(\frac{\partial}{\partial x}\Big)^t f(x).
\end{equation}
Thus the recurrence relation reads
\begin{equation}
\label{eq:hermite_gaussian_recurrence}
 x_P \Lambda_t = \frac{1}{2p}\Lambda_{t+1} + t\Lambda_{t-1}.
\end{equation}

\subsection{Overlap integral $S_{ab}$}
Our goal is to compute the overlap integral
\begin{equation}
S_{ab}  = \langle G_a|G_b\rangle = \int d\vec r \,\Omega_{ab}(\vec r)
\end{equation}
between two Gaussians centered at the points $\vec A$ and $\vec B$.
Note that since the overlap distribution $\Omega_{ab}$ factorise in the Cartesian components, the integrals over $x$, $y$ and $z$ can be calculated independently of each other:
\begin{equation}
\begin{split}
 S_{ab} = & \langle G_i|G_j\rangle \langle G_k|G_l\rangle \langle G_m|G_n\rangle \\
        = & S_{ij}\,S_{kl}\,S_{mn}.
\end{split}
\end{equation}
The $x$ component of the overlap integral, for example, is given by
\begin{equation}
\label{eq:intG_ij}
\begin{split}
 S_{ij} = & \int dx \,\Omega_{ij}(x) \\
        = & K_{AB}^x\int dx \,x_A^ix_B^j\exp(-px_P^2).
\end{split}
\end{equation}
In equation (\ref{eq:intG_ij}) the two-center Gaussians have been reduced to a one-center Gaussian.
However, the integral is still not straightforward to calculate because of the powers $x_A^i$ and $x_B^j$. A smart way to deal with this is to express the Cartesian Gaussian
in terms of the Hermite Gaussians. Note that (\ref{eq:HermiteGaussian_x}) is a polynomial of order $t$ in $x$ multiplied by the exponential function. In equation (\ref{eq:intG_ij}) the polynomial
is of order $i+j$. This means that we can express the overlap distribution $\Omega_{ij}(x)$ in equation (\ref{eq:intG_ij}) in terms of the Hermite Gaussians in (\ref{eq:HermiteGaussian_x}) in the following way:
\begin{equation}
\label{eq:LinCombOfHermGauss}
 \Omega_{ij}(x) = \sum_{t=0}^{i+j} E^{ij}_t \Lambda_t(p, x_P),
\end{equation}
where $E^{ij}_t$ are constants.
Note that the sum is over $t$ only. The indices $i$ and $j$ are static and are determined from the powers of $x$ in $G_i$ and $G_j$.
We use them as labels on the coefficients $E^{ij}_t$ because different sets of indices will lead to different sets of coefficients.

To get the overlap integral in the $x$-direction we integrate (\ref{eq:LinCombOfHermGauss}) over $\mathbb{R}$, which now turns out to be extremely easy;
the only term that survives the integration is the term for $t=0$:
\begin{eqnarray}
 \int dx\,\Lambda_t(p,x_P) & = & \int dx\,\Big(\frac{\partial}{\partial P_x}\Big)^t\exp(-p\,x^2_P), \\
                           & = & \Big(\frac{\partial}{\partial P_x}\Big)^t \int dx\,\exp(-p\,x^2_P), \\
                           & = & \sqrt{\frac{\pi}{p}}\,\delta_{t0}.
\end{eqnarray}
We have used Leibniz' rule, which says that the differentiation of an integrand with respect to a variable which is not an integration variable can
be moved outside the integral. Thus the integral in (\ref{eq:intG_ij}) is simply
\begin{equation}
 S_{ij} = E^{ij}_0\,\sqrt{\frac{\pi}{p}}.
\end{equation}
The exact same procedure can be used for the integrals with respect to $y$ and $z$, which means that the total overlap integral is
\begin{equation}
\label{eq:S_ab}
 S_{ab} = E^{ij}_0\,E^{kl}_0\,E^{mn}_0\,\Big(\frac{\pi}{p}\Big)^{3/2}.
\end{equation}
So far nothing has been said about how we actually determine the coefficients $E^{ij}_t$. First observe that when $i=j=0$ in equation (\ref{eq:LinCombOfHermGauss})
we obtain
\begin{equation}
 E^{0,0}_0 = K_{AB}^x.
\end{equation}
The other coefficients are found via the following recurrence relations
\begin{equation}
\label{eq:E_recurrence}
\begin{split}
 E^{i+1,j}_t & = \frac{1}{2p}E^{ij}_{t-1} + X_{PA}E^{ij}_t + (t+1)E^{ij}_{t+1} \\
 E^{i,j+1}_t & = \frac{1}{2p}E^{ij}_{t-1} + X_{PB}E^{ij}_t + (t+1)E^{ij}_{t+1}.
\end{split}
\end{equation}
Analogous expressions hold for the coefficients $E^{kl}_u$ and $E^{mn}_v$. The first equation in (\ref{eq:E_recurrence}) can be derived by comparing two equivalent ways of expanding the product $G_{i+1}G_j$
in Hermite Gaussians. The first way is
\begin{equation}
 G_{i+1}\,G_j= \sum_{t=0}^{i+j+1}E^{i+1,j}_t \Lambda_t,
\end{equation}
and the second way is
\begin{equation}
\label{eq:derivation_E_coeffs}
\begin{split}
 G_{i+1}\,G_j & = x_A G_i\,G_j \\
              & = [(x - P_x) + (P_x - A_x)]\sum_{t=0}^{i+j} E^{ij}_t \Lambda_t\\
              & = \sum_{t=0}^{i+j}[x_P + X_{PA}] E^{ij}_t \Lambda_t \\
              & = \sum_{t=0}^{i+j}[\frac{1}{2p}\Lambda_{t+1} + t\Lambda_{t-1} + X_{PA}\Lambda_t]E^{ij}_t \\
              & = \sum_{t=0}^{i+j+1}[\frac{1}{2p}E^{ij}_{t-1} + X_{PA}E^{ij}_t + (t+1)E^{ij}_{t+1}] \Lambda_t,
\end{split}
\end{equation}
where we have used the recurrence relation (\ref{eq:hermite_gaussian_recurrence}) on the fourth line and changed the summation indices on the fifth line. Comparing the two expressions gives the
desired result.

Note that the change in summation indices in equation (\ref{eq:derivation_E_coeffs}) implies that we must define
\begin{equation}
 E^{ij}_t = 0, \qquad \text{if }t<0\text{ or }t > i + j.
\end{equation}

\subsection{Kinetic integral $T_{ij}$}
Next we turn to the evaluation of the kinetic integral:
\begin{equation}
\begin{split}
T_{ab} & = -\frac{1}{2}\bra{G_a}\nabla^2\ket{G_b} \\
       & = -\frac{1}{2}\bra{G_{ikm}(a, \vec r_A)}\nabla^2\ket{G_{jln}(b, \vec r_B)} \\
       & = -\frac{1}{2}(T_{ij}\,S_{kl}\,S_{mn} + S_{ij}\,T_{kl}\,S_{mn} + S_{ij}\,S_{kl}\,T_{mn}),
\end{split}
\end{equation}
where
\begin{equation}
 T_{ij} = \int dx \,G_i(a,x_A)\frac{\partial^2}{\partial x^2}G_j(b,x_B),
\end{equation}
and the other factors are defined in the same way. Performing the differentiation yields
\begin{equation}
 T_{ij} = 4b^2\,S_{i,j+2} - 2b(2j + 1)S_{i,j} + j(j-1)S_{i,j-2}.
\end{equation}
Thus we see that the kinetic integrals are calculated easily as products of the overlap integrals.

\subsection{Coulomb integral $V_{ab}$}
\label{sec:V_ab}
We now turn to the Coulomb integral due to the interaction between the electrons and the nuclei
\begin{equation}
 V_{ab} = \bra{G_a}\frac{1}{r_C}\ket{G_b},
\end{equation}
where $r_C = |\vec r - \vec C|$. As before, the overlap distribution is expanded in the Hermite Gaussians:
\begin{equation}
\begin{split}
 V_{ab} & = \int d\vec r \,\frac{\Omega_{ab}(\vec r)}{r_C} \\
        & = \sum_{tuv}E^{ij}_t E^{kl}_u E^{mn}_v\int d\vec r \, \frac{\Lambda_{tuv}(p,\vec r_P)}{r_C} \\
        & = \sum_{tuv}E^{ab}_{tuv}\int d\vec r \, \frac{\Lambda_{tuv}(p,\vec r_P)}{r_C}. \\
\end{split}
\end{equation}
Here we have used the shorthand notation
\begin{equation}
 E^{ab}_{tuv} = E^{ij}_t E^{kl}_u E^{mn}_v.
\end{equation}
In this integral other terms besides $\Lambda_{000}$ will survive due to the factor $1/r_C$. Let us nonetheless start by evaluating this term
\begin{equation}
 V_p = \int d\vec r \, \frac{\Lambda_{000}(p,\vec r_P)}{r_C} = \int d\vec r\, \frac{\exp(-p\,r_P^2)}{r_C}.
\end{equation}
We will show that this three-dimensional integral can actually be converted to a one-dimensional one. The trick is to observe that the factor $1/r_C$ can be replaced by the integral
\begin{equation}
 \frac{1}{r_C} = \frac{1}{\sqrt{\pi}}\int_{-\infty}^\infty dt\,\exp(-r^2_C\,t^2).
\end{equation}
Inserting this into $V_p$ and using the Gaussian product theorem gives
\begin{eqnarray}
 V_p & = & \int \exp(-p\,r_P^2)\Big(\frac{1}{\sqrt{\pi}}\int_{-\infty}^\infty\exp(-r^2_C\,t^2)\,dt\Big)\,d\vec r \\
     & = & \frac{1}{\sqrt{\pi}}\int_{-\infty}^\infty\int\exp\Big(-\frac{pt^2}{p + t^2}R^2_{PC}\Big)\,\exp[-(p + t^2)r^2_S] d\vec r\, dt,
\end{eqnarray}
where $\vec R_{PC} = \vec P - \vec C$ and $\vec r_S = \vec r - \vec S$ for some point $\vec S$. Doing the integral over the spatial coordinates reveals that the specific value of $\vec S$ is immaterial:
\begin{eqnarray}
 V_p & = & \frac{1}{\sqrt{\pi}}\int_{-\infty}^\infty\exp\Big(-\frac{pt^2}{p + t^2}R^2_{PC}\Big)\Big(\frac{\pi}{p + t^2}\Big)^{3/2}\,dt \\
     & = & 2\pi\int_0^\infty\exp\Big(-\frac{pt^2}{p + t^2}R^2_{PC}\Big)\frac{dt}{(p + t^2)^{3/2}}.
\end{eqnarray}
Next we change integration variable from $t$ to $u$ by defining
\begin{equation}
 u^2 = \frac{t^2}{p + t^2}.
\end{equation}
This will change the range of integration from $[0,\infty\rangle$ to $[0,1]$. This is beneficial because the final integral at which we arrive will be calculated numerically.
The change of variables leads to
\begin{align}
\label{eq:V_p}
 V_p & = \frac{2\pi}{p}\int_0^1\exp(-p\,R^2_{PC}\,u^2)\,du \\
     & = \frac{2\pi}{p}F_0(p\,R^2_{PC}),
\end{align}
where $F_0(x)$ is a special instance of the Boys function $F_n(x)$ which is defined as
\begin{equation}
 F_n(x) = \int_0^1\exp(-xt^2)\,t^{2n}\,dt.
\end{equation}
How to actually evaluate the Boys function will be discussed in section \ref{section:Boys}.

We have now a tremendously simplified way of calculating the integral of $\Lambda_{000}/r_C$. However, we need to integrate $\Lambda_{tuv}/r_C$ for general values of $t$, $u$ and $v$.
These integrals are actually not that hard to do once the Boys function is calculated:
\begin{align}
 V_{ab} & = \sum_{tuv}E^{ab}_{tuv}\int d\vec r \, \frac{\Lambda_{tuv}(p,\vec r_p)}{r_C} \\
        & = \frac{2\pi}{p}\sum_{tuv}E^{ab}_{tuv} \frac{\partial^{t+u+v} F_0(p R^2_{PC})}{\partial P_x^t \partial P_y^u \partial P_z^v} \\
        & = \frac{2\pi}{p}\sum_{tuv}E^{ab}_{tuv} R_{tuv}(p,\vec R_{PC}), \label{eq:V_ab}
\end{align}
where we have defined
\begin{equation}
 R_{tuv}(a,\vec A) = \frac{\partial^{t+u+v} F_0(a A^2)}{\partial A_x^t \partial A_y^u \partial A_z^v}.
\end{equation}
So we need to know how to calculate derivatives of the function $F_0$. Note first that
\begin{equation}
 \frac{d}{dx}F_n(x) = -F_{n+1}(x).
\end{equation}
This means that it is possible to derive analytical expressions for the Coulomb term $V_{ab}$. However, in practice they are calculated recursively in a manner similar to the way we calculate
the coefficients $E^{ij}_t$. Before presenting the recursion relations, we introduce the so-called auxiliary Hermite integrals
\begin{equation}
 R^n_{tuv}(a,\vec A) = (-2a)^n\,\frac{\partial^{t+u+v} F_n(a A^2)}{\partial A_x^t \partial A_y^u \partial A_z^v}.
\end{equation}
By starting with the source terms $R^n_{000}(a,\vec A) = (-2a)^n\,F_n(a A^2)$ we can reach the targets $R^0_{tuv}(a,\vec A) = R_{tuv}(a,\vec A)$ through the following
recurrence relations
\begin{equation}
\label{eq:R_recurrence}
 \begin{split}
  R^n_{t+1,u,v} & = tR^{n+1}_{t-1,u,v} + A_x R^{n+1}_{tuv} \\
  R^n_{t,u+1,v} & = uR^{n+1}_{t,u-1,v} + A_y R^{n+1}_{tuv} \\
  R^n_{t,u,v+1} & = vR^{n+1}_{t,u,v-1} + A_z R^{n+1}_{tuv}.
 \end{split}
\end{equation}
The first of these are derived as follows
\begin{align}
 R^{n}_{t+1,u,v} & = (-2a)^n\frac{\partial^{t+u+v}}{\partial A_x^t \partial A_y^u \partial A_z^v} [2aA_xF'_n(aA^2)] \\
                 & = (-2a)^{n+1}\frac{\partial^{t+u+v}}{\partial A_x^t\partial A_y^u \partial A_z^v}\Big[A_xF_{n+1}(aA^2)\Big] \\
                 & = (-2a)^{n+1}\frac{\partial^{u+v}}{\partial A_y^u \partial A_z^v}\Big[t\frac{\partial^{t-1}}{\partial A_x^{t-1}} + A_x\frac{\partial^t}{\partial A_x^t}\Big]F_{n+1}(aA^2) \\
                 & = tR^{n+1}_{t-1,u,v} + A_xR^{n+1}_{tuv},
\end{align}
where we have used equation (\ref{eq:derivation_rule}) and the fact that $F'_n(x) = -F_{n+1}(x)$.
% From these relations it is clear that in order to calculate the values of $R_{tuv}(p,\vec R_{PC})$ needed in (\ref{eq:V_ab}), the Boys function $F_n(p, R^2_{PC})$ has to be
% evaluated for $n\in\{0,\dots,\mathrm{max}(t_{max}, u_{max}, v_{max})\}$.

\subsection{Coulomb integral $g_{acbd}$}
\label{sec:g_abcd}
Finally we show how to calculate the Coulomb integral due to the interaction between the electrons. It is given by\footnote{Here $G_a$ is combined with $G_b$ and $G_c$ combined with
$G_d$ using the Gaussian product rule. In many books on quantum chemistry this is written as \newline
$\left(G_a(1) G_b(1)|r^{-1}_{12}|G_c(2) G_d(2)\right) =\int\int d\vec r_1 d\vec r_2 G_a(\vec r_1) G_b(\vec r_1) r^{-1}_{12} G_c(\vec r_2) G_d(\vec r_2)$. However, since this
departs from the usual notation of quantum physics, it will not be used in this thesis.}
\begin{equation}
\begin{split}
  g_{acbd} & = \bra{G_a G_c}\frac{1}{r_{12}}\ket{G_b G_d} \\
           & = \int\int \frac{\Omega_{ab}(\vec r_1)\Omega_{cd}(\vec r_2)}{r_{12}} d\vec r_1 d\vec r_2 \\
           & = \sum_{tuv}\sum_{\tau\nu\phi}E^{ab}_{tuv}E^{cd}_{\tau\nu\phi}\int\int\frac{\Lambda_{tuv}(p,\vec r_{1P})\Lambda_{\tau\nu\phi}(q,\vec r_{2Q})}{r_{12}}d \vec r_1 d\vec r_2 \\
           & = \sum_{tuv}\sum_{\tau\nu\phi}E^{ab}_{tuv}E^{cd}_{\tau\nu\phi}\frac{\partial^{t+u+v}}{\partial P_x^t \partial P_y^u \partial P_z^v}
                \frac{\partial^{\tau+\nu+\phi}}{\partial Q_x^\tau \partial Q_y^\nu \partial Q_z^\phi} \\
           &    \hspace{30mm} \int\int\frac{\exp(-pr^2_{1P})\exp(-qr^2_{2Q})}{r_{12}}d \vec r_1 d\vec r_2,
\end{split}
\end{equation}
where, analogous to $p$ and $\vec r_{1P}$, we have defined
\begin{equation}
 \begin{split}
    q = & c + d\\
  \vec r_{2Q} = & \vec r_2 - \vec Q \\
  \vec Q = & \frac{c\,\vec C + d\,\vec D}{c + d}.
 \end{split}
\end{equation}
Thus we need to evaluate the integral
\begin{equation}
 V_{pq} = \int\int\frac{\exp(-pr^2_{1P})\exp(-qr^2_{2Q})}{r_{12}}d \vec r_1 d\vec r_2.
\end{equation}
By first integrating over $\vec r_1$ and using equation (\ref{eq:V_p}) this can be written as
\begin{equation}
 V_{pq} = \int\Big(\frac{2\pi}{p}\int_0^1\exp(-p\,r^2_{2P}\,u^2)\,du\Big)\exp(-qr^2_{2Q}) d \vec r_2.
\end{equation}
Next we change the order of integration and use the Gaussian product theorem to get
\begin{equation}
\begin{split}
 V_{pq} & = \frac{2\pi}{p}\int_0^1\int\exp(-\frac{pqu^2}{pu^2+q}R^2_{PQ})\exp[-(pu^2+q)r_{2S}^2] d\vec r_2 du \\
        & = \frac{2\pi}{p}\int_0^1\exp(-\frac{pqu^2}{pu^2+q}R^2_{PQ})\Big(\frac{\pi}{pu^2+q}\Big)^{3/2} du,
\end{split}
\end{equation}
where $\vec R_{PQ} = \vec P - \vec Q$ and $\vec r_{2S} = \vec r_2 - \vec S$ for some point $\vec S$. Again, the actual coordinates of
$\vec S$ are immaterial. If we now make the change of variable
\begin{equation}
 \frac{v^2}{p+q} = \frac{u^2}{pu^2+q},
\end{equation}
we get the result
\begin{equation}
 V_{pq} = \frac{2\pi^{5/2}}{pq\sqrt{p+q}}F_0\Big(\frac{pq}{p+q}R^2_{PQ}\Big).
\end{equation}
From this we get the final answer
\begin{equation}
\begin{split}
 g_{acbd} & = \frac{2\pi^{5/2}}{pq\sqrt{p+q}}\sum_{tuv}\sum_{\tau\nu\phi}(-1)^{\tau+\nu+\phi}E^{ab}_{tuv}E^{cd}_{\tau\nu\phi} \\
          & \hspace{40mm} \frac{\partial^{t+u+v+\tau+\nu+\phi}}{\partial P_x^{t+\tau} \partial P_y^{u+\nu} \partial P_z^{v+\phi}}F_0\Big(\frac{pq}{p+q}R^2_{PQ}\Big) \\
          & = \frac{2\pi^{5/2}}{pq\sqrt{p+q}}\sum_{tuv}\sum_{\tau\nu\phi}(-1)^{\tau+\nu+\phi}E^{ab}_{tuv}E^{cd}_{\tau\nu\phi}R_{t+\tau,u+\nu,v+\phi}(\alpha,\vec R_{PQ}),
\end{split}
\end{equation}
where $\alpha = pq/(p+q)$. The term $(-)^{\tau+\nu+\phi}$ arises due to the fact that
\begin{equation}
\frac{\partial}{\partial Q_x} F_0\Big(\frac{pq}{p+q}R^2_{PQ}\Big) = - \frac{\partial}{\partial P_x} F_0\Big(\frac{pq}{p+q}R^2_{PQ}\Big).
\end{equation}

\section{The Boys function}
\label{section:Boys}

As shown in the previous section, calculating the Coulomb integrals boils down to evaluating the Boys function
\begin{equation}
\label{eq:boys}
 F_n(x) = \int_0^1\exp(-xt^2)\,t^{2n}\,dt.
\end{equation}
Doing this by standard numerical procedures is compuationally
expensive and should therefore be avoided. This section describes one possible way to calculate the Boys function efficiently.

First note that if $x$ is very large, the function value will hardly be affected by changing the upper limit of the integral from $1$ to $\infty$. Doing this is beneficial
because then the integral can be calculated exactly. Thus, we have the following approximation for the Boys function for large $x$:
\begin{equation}
 F_n(x) \approx \frac{(2n-1)!!}{2^{n+1}}\sqrt{\frac{\pi}{x^{2n+1}}}. \hspace{15mm} (x\hspace{2mm}\mathrm{large})
\end{equation}
For small values of $x$ there seems to be no escape from numerical calculation. However, instead of doing the integral at the time of computation,
it can be tabulated once and for all at regular values of $x$. For values between the tabulated ones, the function can be calculated by a Taylor expansion centered at the nearest tabulated point $x_t$:
\begin{equation}
 F_n(x_t+\Delta x) = \sum_{k=0}^\infty\frac{F_{n+k}(x_t) (-\Delta x)^k}{k!}. \hspace{15mm} (x\hspace{2mm}\mathrm{small})
\end{equation}
Computational cost can be reduced even further by calculating the Boys function according to the description above only for the highest values of $n$ needed; for lower values of $n$ the function
can be found via the recursion relation
\begin{equation}
 F_n(x) = \frac{2xF_{n+1}(x)+e^{-x}}{2n+1},
\end{equation}
which can be shown by integrating the function by parts.

\section{Summary of the integration scheme}
In the previous sections the integration scheme for GTOs has been derived. We summarise the results in this section. Some of the results are only elaborated fully for the $x$-component as
the others components are defined similarly.

\subsection*{Gaussian functions}
The Gaussian functions are given by
\begin{equation}
 \begin{split}
  G_a(\vec r) & = G_{ikm}(a, \vec r_A) = x^i_A\,y^k_A\,z^m_A\exp(-a r^2_A), \\
  G_b(\vec r) & = G_{jln}(b, \vec r_B) = x^j_B\,y^l_B\,z^n_B\exp(-b r^2_B),
 \end{split}
\end{equation}
where $\vec r_A = \vec r - \vec A$ and $\vec r_B = \vec r - \vec B$. We further define
\begin{equation}
\begin{split}
  p & = a + b, \\
 \vec P & = \frac{a\vec A + b\vec B}{a + b}.
\end{split}
\end{equation}

\subsection*{Overlap integral $S_{ab}$}
The overlap integral
\begin{equation}
 S_{ab} = \langle G_a|G_b\rangle
\end{equation}
is calculated as
\begin{equation}
\label{eq:Sab_compute}
 S_{ab} = E^{ij}_0\,E^{kl}_0\,E^{mn}_0\,\Big(\frac{\pi}{p}\Big)^{3/2},
\end{equation}
where
\begin{equation}
 E^{i=0,j=0}_0 = \exp(-\frac{ab}{a+b}X_{AB}^2),
\end{equation}
and the desired coefficients are found via
\begin{equation}
\begin{split}
 E^{i+1,j}_t & = \frac{1}{2p}E^{ij}_{t-1} + X_{PA}E^{ij}_t + (t+1)E^{ij}_{t+1}, \\
 E^{i,j+1}_t & = \frac{1}{2p}E^{ij}_{t-1} + X_{PB}E^{ij}_t + (t+1)E^{ij}_{t+1}.
\end{split}
\end{equation}

\subsection*{Kinetic integral $T_{ab}$}
The kinetic integral is calculated as
\begin{equation}
\label{eq:Tab_compute}
 T_{ab} = -\frac{1}{2}(T_{ij}\,S_{kl}\,S_{mn} + S_{ij}\,T_{kl}\,S_{mn} + S_{ij}\,S_{kl}\,T_{mn}),
\end{equation}
where
\begin{equation}
 T_{ij} = 4b^2\,S_{i,j+2} - 2b(2j + 1)S_{i,j} + j(j-1)S_{i,j-2}.
\end{equation}

\subsection*{Coulomb integral $V_{ab}$}
The Coulomb integral
\begin{equation}
 V_{ab} = \bra{G_a}\frac{1}{r_C}\ket{G_b}
\end{equation}
is calculated as
\begin{equation}
\label{eq:Vab_compute}
 V_{ab} = \frac{2\pi}{p}\sum_{tuv}E^{ab}_{tuv} R_{tuv}(p,\vec R_{PC}),
\end{equation}
where
\begin{equation}
 E^{ab}_{tuv} = E^{ij}_t\,E^{kl}_u\,E^{mn}_v,
\end{equation}
and $R_{tuv}(a,\vec A)$ is found by first calculating the source term
\begin{equation}
 R^n_{000}(a,\vec A) = (-2a)^n\,F_n(a A^2)
\end{equation}
and then iterating towards the target $R^0_{tuv}(a,\vec A) = R_{tuv}(a,\vec A)$ via the recurrence relations
\begin{equation}
 \begin{split}
  R^n_{t+1,u,v} & = tR^{n+1}_{t-1,u,v} + A_x R^{n+1}_{tuv}, \\
  R^n_{t,u+1,v} & = uR^{n+1}_{t,u-1,v} + A_y R^{n+1}_{tuv}, \\
  R^n_{t,u,v+1} & = vR^{n+1}_{t,u,v-1} + A_z R^{n+1}_{tuv}.
 \end{split}
\end{equation}

\subsection*{Coulomb integral $g_{acbd}$}
The Coulomb integral
\begin{equation}
 g_{acbd} = \bra{G_a G_c}\frac{1}{r_{12}}\ket{G_b G_d}
\end{equation}
is calculated as
\begin{equation}
\label{eq:gabcd_compute}
 g_{acbd} = \frac{2\pi^{5/2}}{pq\sqrt{p+q}}\sum_{tuv}\sum_{\tau\nu\phi}(-1)^{\tau+\nu+\phi}E^{ab}_{tuv}E^{cd}_{\tau\nu\phi}R_{t+\tau,u+\nu,v+\phi}(\alpha,\vec R_{PQ}),
\end{equation}
where
\begin{equation}
  \alpha = \frac{pq}{p + q}.
\end{equation}


%!TEX root = ../../dissertacao.tex
This chapter~\label{chap:inductive} shows a brief introduction on formal verification and a more detailed explanation on the selected approach to be used in this work: the Inductive Method. The concepts will be restricted to the necessary elements needed for comprehension of the proposed problem.

\section{Formal Verification}
Using the previous definitions for security protocols, we note that one can reason about protocol rules, \textit{verifying} if they are correct with respect to the protocol's goals.

Informal reasoning on verifying protocols was the first attempt to guarantee their correctness, succeeding in recognizing some flaws and weaknesses quickly and providing a good understanding about protocols design~\cite{Bella2007}. However, not finding an error does not mean that a certain model does not hold one, since informal methods may fail to identify critical flaws in major security protocols.

A classical example is the Needham-Schröeder protocol~\cite{NeedhamSchroeder78}. Despite the authors efforts on its specification and informal verification, security flaws were found using formal techniques based on Lowe's work~\cite{Lowe96}. This was an optimal context for the rise of formal methods for verifying security protocols~\cite{Meadows96, Meadows94, Kemmerer94, Burrows90}, providing a mathematical approach for reasoning about abstract protocols models.

Formal verification requires the definition of such protocols in a proper language, suitable for the application of specific methods and, hopefully, the use of automated reasoning tools, improving proof methodology. Also, formal methods can be divided in two major categories, according to~\cite{BoydMathuria2008}:

\begin{itemize}
  \item \textbf{Model checking}: protocol behavior can be modeled as a finite set of states. Such proposal is suitable for checking if a given configuration satisfy a set of correctness conditions and analyze a certain past configuration, searching for attacks attempts. This approach is more appropriate for finding inconsistencies and attacks in the protocol rather than proving some of its correctness properties;

  \item \textbf{Theorem proving}: the protocol can described as a model, where \textit{all} possible behavior are considered. Thus, any wanted property must be described as a theorems and proved using the axioms stated by the model. This method is more suitable for proving the correctness and properties of the protocol rather than finding possible attacks on them.
\end{itemize}

\section{Method Introduction}\label{sec:inductive-method}
The Inductive Method is a proof theory for modeling and reasoning about security protocol, which aims for both the formalization and the verification of such protocols, using model checking and structural induction. First, the intended protocol \(\mathcal{P}\) must be defined as an inductively constructed model \(P\), composed by rules describing the real world steps of \(\mathcal{P}\).

An infinitely countable set of agents is considered, who can fire events accordingly with the model \(P\), in any desired order or regularity. Agents can interleave between protocol sessions with their actions indefinitely. Among the agents, we stress a special one, the Spy, who has control over the network and compromised agents, it is used to model the threat scenario.

At a second stage, the model is verified towards proposed properties, reasoning along technical and theoretical traits. Here, structural induction takes a crucial role. If a security property must hold for the protocol, it must hold for all possible traces derived from the formal model \(P\), hence induction over the set of possible network traces is the main proof tool used in this phase.

Induction has been previously used for the formalization of protocol, for example in the NRL Protocol Analyzar by C.~Meadows~\cite{Meadows96}, and the Inductive Method has similarities with other model checking theories, like CSP~\cite{RyanSchneider2010}. It comprehends a strong threat model and concurrency among peers, however it does not check liveness properties. Moreover, the framework on which it is built provides easy ways for extension, allowing steady formalizations of atypical systems, a feature which interests us.

The method was first proposed by L.~Paulson~\cite{Paulson98} and extended by G.~Bella~\cite{Bella2007}. It has been used for the verification of many deployed and significant protocols~\cite{Paulson99, BellaPaulson2006, Bella2003}.

\subsection{Isabelle}
Given the considerably great number of possible agents and possible traces which can be derived from a model, correctness proofs can take a substantial amount of work. As a result, the use of an automatic theorem prover is desirable. Isabelle~\cite{isabelle} is one of such systems, where the theory framework is built on, providing machine verifiable and maintainable proofs scripts.

Isabelle is a generic theorem prover, which can reason over several formal systems, in an interactive way. Hence, proofs are not entirely automatic, requiring certain user guidance. It combines high order logic, typed formalism and quantifiers for functions, predicates and sets. Also, the system has a good range of proof tools: simplifiers, induction-oriented commands and access to some automatic provers and state-of-the-art theories.

Lemmas and theorems are stated as goals, to which the user must apply proof tactics, being able to use previously proved lemmas. Such process may derive subgoals, which also need to be dealt with. Hence, the proof process is arduous and must be done with care. If an user fails to find a proof for a certain property, this may not be a certification of the nonexistence of a proof. At the same time, the proof or some of its aspects may be built on top of wrong formalizations, meaning the user is not skilled enough.

Each formalized theory in Isabelle is contained in a proof script. Also, each Isabelle distribution comes with a library of such formalizations. The Inductive Method framework is defined in the \textit{Auth} library~\cite{isabelle-hol-auth}, comprised in three files: \texttt{Message.thy}, \texttt{Event.thy} and \texttt{Public.thy}. The content of those files will be depicted over the rest of this chapter, where some of Isabelle syntax will be presented, when convenient.

\subsection{Agents}
Agents are described in the \texttt{Message.thy} file, being the basic type for specifying participants in a protocol session. Three main entities are defined as free types: legal agents (Friends ), the Spy and the Server. In the definition below, the \( \triangleq \) symbol reads as a definition equality operator for a keyword and the \(|\) symbol is the disjunction operator, separating the possible types for the \texttt{agent} datatype.

\begin{center}
  {\ttfamily datatype agent \( \triangleq \) Server | Spy | Friend \(nat\)}
\end{center}

The set of legal agents has a correspondence with the set of natural numbers. Thus, we have both an easy mapping for each participant of a protocol session and removal of limitations of its population size, providing the ability to reason over protocols with an indefinite and infinite number of peers.

The nullary constructor \texttt{Server} defines the trusted third part entity, presented in many protocols. It is considered uncompromisable and holds the long-term secrets (keys) of all agents. The Spy is the malicious agent, but who can also act as a legal one. She has access to the secrets of all compromised agents and her own secrets.

\subsection{Cryptographic Keys}
Also defined in \texttt{Message.thy}, cryptographic keys are bounded to the natural numbers, but constrained within a proper set. Later, each type of key is normally defined as a relation between the sets of agents and keys. For instance, the habitual specification of shared keys is defined as follows, where the \( \longrightarrow \) symbol defines the relation between the type sets.

\begin{center}
  {\ttfamily \(shrK\): agent \( \longrightarrow \) key}
\end{center}

The description of public and private keys structures uses a similar construction. The set \texttt{symKeys} helps in the distinction between of long-term keys and session keys. Both types are considered shared keys, but the latter is commonly a fresh entity generated at protocol runtime and distributed among peers. Below, \texttt{range} is a function which gives us the image of a given function.

\begin{center}
  {\ttfamily \(K \in \) symKeys} and {\ttfamily \(K \notin \) range \(shrK\)}
\end{center}

Finally, the function \(invKey\) receives a key and returns its inverse key, which can decipher any cipher created by the former. If it is applied to a symmetric key, it return the same key, while for asymmetric keys, the respective half is returned. Any other kind of keys not mentioned here must be manually defined.

\subsection{Messages}
A message is any kind of information that can be transmitted during the execution of a protocol. This includes agents names, keys, nonces, timestamps, and so on. Therefore, its constructor accepts many kinds of formats, as stated below:

\begin{equation*}
  \begin{split}
    \texttt{datatype} \triangleq\
    & \texttt{\textbf{Agent} agent} | \\
    & \texttt{\textbf{Nonce} nat} | \\
    & \texttt{\textbf{Key} key} | \\
    & \texttt{\textbf{Mpair} msg msg} | \\
    & \texttt{\textbf{Hash} msg} | \\
    & \texttt{\textbf{Crypt} key msg}
  \end{split}
\end{equation*}

Some of the accepted datatypes are constructors and others are simply natural numbers. If any other datatype is needed, the definition of this scope must be extended.

Another important concept is the \texttt{Crypt} directive. It receives a message \(M\) and a key \(K\) and produces the corresponding cipher, i.e.\ \texttt{Crypt} \(M\ K\). In this model, encryption is perfect and collision-free, so a message is only accessible within a cipher by a peer if she has the proper key.

Some protocol formalizations demand new types of message, since security protocols often resort on numeric entities for soundness of some properties. Significant ones are described below:

\begin{description}
  \item[Nonces] are big random natural numbers which are unguessable to any agent, including the Spy.

  \item[Guessable numbers] are natural numbers, often used to model message option fields, time properties and similar concepts. As a result, they are always known by the Spy.

  \item[Timestamps] are defined on top of the length of a trace, instead of relying on classical time units. Its definition and properties will be further explored in the sections below.
\end{description}

\subsection{Events}
Events, defined in the theory \texttt{Event.thy}, are the basic units that compose network traces. There are three main events, which are suitable for the analyzed protocol in this work, although there are more available for others protocols:

\begin{equation*}
  \begin{split}
    \texttt{datatype} \triangleq\
    & \texttt{\textbf{Says} agent agent msg} \\
    & \texttt{\textbf{Notes} agent msg} \\
    & \texttt{\textbf{Gets} agent msg}
  \end{split}
\end{equation*}

The action of \texttt{Says} is straightforward and it follows easily from its syntax: the first agent is the sender, the second is the intended receiver and the third parameter is the message which will be sent.

Both events \texttt{Notes} and \texttt{Gets} are related to information acquisition by an agent. The former is the literal action of an agent obtaining and storing a given message, enabling them to explore messages contents, deriving new information, and the Spy on collecting data from the network. The latter event denotes message reception by an agent, but without enrichment of agent's knowledge. It was a late extension of the Inductive Method~\cite[Ch. 8]{Bella2007}, in order to explore an agents' knowledge set of messages. Without this, agents' knowledge would be constrained to past events only. Additionally, the creation of such event, introduces the concept of \textit{reception invariant}, demanding that \texttt{Gets} events are preceded by a \texttt{Says} event. This guarantee must be enforced by the protocol model.

A \textit{trace} can now be defined: a list of network events occurring while an unbounded population of agents are running the protocol. Specifically, the trace is a list of such events, disposed in reverse chronological order, since events are added at the list head. Hence, traces may have many configurations, but must stay faithful to the protocol model. The set of possible traces of a given protocol characterizes its formal model.

We can now recall some aspects concerning timestamps. In the Inductive Method, a timestamp describes the moment where an event happened in a trace, using the trace length as the measure. Therefore, for generating a timestamp, the following function is used:

\begin{center}
  {\ttfamily CT\@: event list \(\longrightarrow \) nat}
\end{center}

Thus, the function receives a trace and returns a natural number, which will be the length of that trace, leading to the following definition, where \texttt{length} trivially denotes the function that returns the length of a trace.

\begin{center}
  {\ttfamily CT \(evs \triangleq \) length \(evs\)}
\end{center}

Precisely, the timestamp for a trace which has \(n\) events will be \(n\) and, consequently, an event happening at that moment will receive a timestamp value of \(n\). Note that such definition does not allow that two distinct events have the same timestamp, eliminating concurrency among events in the same trace. Further, this concept is properly guaranteed by the existence of two distinct traces, where such two events happens at switched positions, defining two corresponding sequential approximations.

\subsection{Threat Model}\label{ssec:threat-model}
The standard thread model used in the Inductive Method is based upon the Dolev-Yao~\cite{DolevYao81} approach, introducing three main characteristics concerning the Spy:

\begin{enumerate}
  \item \textit{The Spy is a legitimate agent:} since she can act as a legal agent, she has their same features, such as shared keys with the Server, public asymmetric keys, etc.;

  \item \textit{The Spy controls the network traffic:} this copes with the capability of the Spy on monitoring and obtaining messages sent on network channel and  preventing the delivery or redirecting messages;

  \item \textit{The Spy can perform any message operation, except cryptanalysis:} with this abilities, the Spy can break, compose and modify messages on-the-fly, being able to alter legal messages or create fake ones. There is only one exception, she must hold the correspondent key to a cipher in order to obtain the plain text, which guarantees that any encryption is perfect.
\end{enumerate}

The Inductive Method implements all of these three aspects. The first one is already assured by the definitions of agents and cryptographic keys. Moreover, the protocols models should enable the Spy to participate as a legal action along their runs.

The set \texttt{bad} contains all agents which are compromised by the Spy. These agents disclose all their secrets to the malicious peer, both prior and during the protocol run. The Spy herself is also included in this set. Secrets are contained in the agent's knowledge set, which is a crucial concept for meeting the second requirement of the threat model.

Function \textit{initState} describes the peer knowledge set prior to any protocol interaction, defined as follows.

\begin{center}
  {\ttfamily \(initState\): agent \(\longrightarrow \) msg set}
\end{center}

\begin{enumerate}
  \item The Server initially knows all shared and public keys and its own private keys;
  %
  \begin{equation*}
    \begin{split}
      initState\ \texttt{Server} \triangleq\
      & (\texttt{Key range}\ shrK) \cup (\texttt{Key range}\ pubK)\ \cup \\
      & \{\texttt{Key}\ (priK\ \texttt{Server})\}
    \end{split}
  \end{equation*}
  %
  \item Each legitimate agent initially knows its own shared and private keys and all public keys;
  %
  \begin{equation*}
    \begin{split}
      initState (\texttt{Friend}\ \textit{i}) \triangleq\
      & \{ \texttt{Key}\ (shrK\ (\texttt{Friend}\ i))\}\ \cup \\
      & \{ \texttt{Key}\ (priK\ (\texttt{Friend}\ i))\}\ \cup \\
      & (\texttt{Key range}\ pubK)
    \end{split}
  \end{equation*}
  %
  \item The Spy knows all secrets from a compromised agent, which includes herself. Additionally, she also knows all public keys.
  %
  \begin{center}
    \[
      initState\ \texttt{Spy} \triangleq (\texttt{Key}\ shrK\ \texttt{bad}) \cup (\texttt{Key}\ priK\ \texttt{bad}) \cup (\texttt{Key range}\ pubK)
    \]
  \end{center}
\end{enumerate}

Function \textit{knows} defined how the agents' dynamic knowledge is built during the protocol run. Its definition is presented below, where the symbol \#  denotes the concatenation of an element at the head of a list.
%
\begin{center}
  \(knows\): [\texttt{agent, event list}] \(\longrightarrow \) \texttt{msg set}
\end{center}
%
\begin{enumerate}
  \item An agent knows her initial state
  %
  \begin{center}
    \(knows\ A\ [] \triangleq\ initState\ A\)
  \end{center}
  %
  \item An agent knows what she sends to anyone in a trace and the Spy knows all messages ever sent over it.
  %
  \begin{center}
    \(knows\ A\) ((\texttt{Says} \(A'\ B \ X\)) \# \(evs\)) \(\triangleq \)
    \(\left \{
      \begin{array}{@{}ll@{}}
        {X} \cup knows\ A\ evs, & \text{if } A \in \texttt{bad} \\
        knows\ A\ evs, & \text{otherwise}
      \end{array} \right.\)
  \end{center}
  %
  \item An agent knows what she notes in a trace, while the Spy also knows the compromised agents' notes
  %
  \begin{center}
    \(knows\ A\) ((\texttt{Notes} \(A'\ X\)) \# \(evs\)) \(\triangleq \)
    \(\left \{
      \begin{array}{@{}ll@{}}
        {X} \cup knows\ A\ evs, & \text{if } A = A' \text{ or } \\ & (A = \texttt{Spy} \text{ and } A' \in \texttt{bad}) \\
        knows\ A\ evs, & \text{otherwise}
      \end{array} \right.\)
  \end{center}
  %
  \item An agent, except the Spy, knows what she receives in a trace. The Spy knowledge is not enriched here since she already knows by case 2 and by the reception invariant.
  %
  \begin{center}
    \(knows\ A\) ((\texttt{Gets} \(A'\ X\)) \# \(evs\)) \(\triangleq \)
    \(\left \{
      \begin{array}{@{}ll@{}}
        {X} \cup knows\ A\ evs, & \text{if } A = A' \text{ and } A \neq \texttt{Spy} \\
        knows\ A\ evs, & \text{otherwise}
      \end{array} \right.\)
  \end{center}
\end{enumerate}

It is important to note that the expression \(knows\) \texttt{Spy} \(evs\) expresses the entire network traffic occurred to the point registered in \(evs\). With these formalizations, the attacker's omnipotence requirement for the threat model is fulfilled. For the third one, the definition of message operations will be necessary, as given in the next section.

\subsection{Operators}\label{ssec:operators}
Operators are functions for reasoning about message sets. They translate the act of exploring and producing messages, being defined as follows.

\begin{center}
  \texttt{analz, synth, parts: msg set \(\longrightarrow \) msg set}
\end{center}

In this section, some new symbols are introduced. The symbol \(\Longrightarrow \) denotes a sequent, where \(\Gamma \Longrightarrow \Delta \) reads as {\em if \(\Gamma \) holds, then so does \(\Delta \)}. Also, the \(\lBrack \) and \(\rBrack \) symbols are a shorthand syntax for the \texttt{Mpair} constructor, denoting concatenation of messages, while \(\lBrace \) and \(\rBrace \) are concatenation of clauses in a list.

The \texttt{analz} operator denotes the act of inspecting the components of a message, breaking it up. Therefore, considering the message set \(H\), the set \texttt{analz} \(H\) uses the following rules below.

\begin{enumerate}
  \item Any element of a message set \(H\) can be analyzed from it;
  \begin{center}
    \(X \in H \Longrightarrow X \in \) \texttt{analz} \(H\)
  \end{center}

  \item Any element in a given concatenation of messages, that could be analyzed from its message set, can also be analyzed from it;
  \begin{center}
    \(\Bracks{X,Y} \in \texttt{analz} H \Longrightarrow X \in \) \texttt{analz} \(H\) \\
    \(\Bracks{X,Y} \in \texttt{analz} H \Longrightarrow Y \in \) \texttt{analz} \(H\)
  \end{center}

  \item The contents of an analyzed cyphertext can only properly be analyzed and further retrieved in possession of its decryption key.
  \begin{center}
    \(\Braces{\texttt{Crypt}\ K\ X \in \texttt{analz}\ H; \texttt{Key}\ (invKey\ K) \in \texttt{analz}\ H} \Longrightarrow X \in \texttt{analz}\ H\)
  \end{center}
\end{enumerate}

The set \texttt{analz (spies) \textit{evs}} holds all data that the Spy can gather from the network in the trace \textit{evs}, either by decomposition or decryption of ciphers. Thus, saying a set of message \(X\) does not belong to this set is equivalent to state the confidentiality of \(X\) in such trace.

The second operator is the \texttt{synth}, which basically denotes the action of composing messages from given components. Its rules are the following:

\begin{enumerate}
  \item Any element or agent name can be synthesized from a message set;
  \begin{center}
    \(X \in H \Longrightarrow X \in \texttt{synth}\ H\) \\
    \(\texttt{Agent}\ A \in \texttt{synth}\ H\)
  \end{center}

  \item If a message can be synthesized from a message set, then so it can its hash;
  \begin{center}
    \(X \in \texttt{synth}\ H \Longrightarrow \texttt{Hash}\ X \in \texttt{synth}\ H\)
  \end{center}

  \item If two messages can be synthesized from a message set, then so it can its concatenation;
  \begin{center}
    \(\Braces{X \in \texttt{synth}\ H; Y \in \texttt{synth}\ H} \Longrightarrow \Bracks{X,Y} \in \texttt{synth}\ H\)
  \end{center}

  \item If a key belongs to a message set and a message can be synthesized from it as well, then so the encryption of the message with the given key.
  \begin{center}
    \(\Braces{\texttt{Key}\ K \in H; X \in \texttt{synth } H} \Longrightarrow \texttt{Crypt}\ K\ X \in \texttt{synth}\ H\)
  \end{center}
\end{enumerate}

Finally, the last operator \texttt{parts} is very similar to the \texttt{analz} operator, hence its rules are similar to the latter, except the one concerning encryption:

\begin{enumerate} \setcounter{enumi}{3}
  \item The contents of any cyphertext can be obtained.
  %
  \begin{center}
    \(\texttt{Crypt}\ K\ X \in \texttt{parts}\ H \Longrightarrow X \in \texttt{parts}\ H\)
  \end{center}
\end{enumerate}

Thereby, the extraction of messages from ciphers does not require a key in this operator, simulating unbounded computational power. This operator is mainly used in analysis of agents' knowledge sets along proofs and not used to give an agent unlimited power over sets of messages. Additionally, the following relation can be derived concerning the last two operators:

\begin{center}
  \texttt{analz} \(\subseteq \) \texttt{parts}
\end{center}

Finally, \textit{freshness} can be defined. Normally, nonces and session keys demand to be freshly generated in order to increase security. To analyze this properties for a given message the following function is defined, which receives a trace and return the messages used in that trace:

\begin{center}
  \(used\): \texttt{event list} \(\longrightarrow \) \texttt{msg set}
\end{center}

\begin{enumerate}
  \item All components of any agent's initial state are used in a trace, including the empty one
  %
  \begin{center}
    \(used\ [] \triangleq \bigcup A\). \texttt{parts}\( (initState\ A)\)
  \end{center}
  %
  \item All components of messages sent in a trace are used in that trace
  %
  \begin{center}
    \(used\ A\) ((\texttt{Says} \(A\ B\ X\)) \# \(evs\)) \(\triangleq \) \texttt{parts} \( \{X\} \cup used\ evs\)
  \end{center}
  \item All components of messages noted in a trace are used in that trace
  %
  \begin{center}
    \(used\ A\) ((\texttt{Notes} \(A\ X\)) \# \(evs\)) \(\triangleq \) \texttt{parts} \( \{X\} \cup used\ evs\)
  \end{center}
  \item All components of messages received in a trace do not count as used, due to reception invariant and hence, they are already considered as used.
  %
  \begin{center}
    \(used\ A\) ((\texttt{Gets} \(A\ X\)) \# \(evs\)) \(\triangleq \) \texttt{parts} \( \{X\} \cup used\ evs\)
  \end{center}
\end{enumerate}

Hence, it is said to a component to be fresh in a given protocol execution when such component was not used prior to that execution.

\subsection{Protocol Model}
Once all elements are properly defined, we are able to formally define the protocol model. As previously stated, the model will be structured as a set of unlimited traces, representing all possible network histories induced by the protocol. Here, we use the protocol in Figure~\ref{prt:notation-example} as the basis for our example. The corresponding model is presented in Figure~\ref{fig:notation-example-model}.

The model rules are composed by two parts. The first part are the preconditions, a list of clauses that need to be true in order to fire the correspondent event. The latter are the postconditions, which states which events will be added to the head of the trace, composing the network history.

Rule \texttt{Nil} is the base case, where the empty trace is a valid trace in a protocol session. Rules \texttt{DSP1} and \texttt{DSP2} emulate the protocol steps, hence if a protocol has \(n\) parts, the model should contain at least \(n\) rules. A regular precondition among rules are that the trace must be faithful to the model, thus, considering a trace \(evs\), then \(evs\) should belong to the model. In rule \texttt{DP2}, we see that the preconditions contains a \texttt{Gets} event resembling rule \texttt{DP1}, showing a common formalization of how rules demand previous ones.

The rule \texttt{Fake} aides the formalization of the threat context, where the Spy can fake a message \(X\) once she has the necessary knowledge, i.e.\ message \(X\) belongs to the set of data which can be constructed based on her knowledge set. The rule \texttt{Oops} abstracts the loss of a session key to the Spy by accident. This local security breach is used to model specific situations where a lost session key could affect future protocol sessions. Thus, this rule only concerns protocol involving this kind of keys.

Finally, the rule \texttt{Rcpt} is meant to fulfill the \textit{reception invariant}, i.e.\ a message can only be received if it was previously sent. Note that it does not guarantee that sent messages will ever be received, but only enforces that traces with \texttt{Gets} events must have a matching \texttt{Says} event.

\begin{figure}\label{fig:notation-example-model}
  \centering
  \includegraphics[width=0.8\textwidth]{img/prt-example-model}
  \caption{Formal model for the protocol displayed in Figure~\ref{prt:notation-example}}
\end{figure}

\section{Goals Verification}
Security protocols have technical properties that are inherent to its system, outlining how peers should communicate and the protocol proceed. Meanwhile, other important security aspects, introduced in Chapter~\ref{chap:sec-protocols}, are another kind of features that should be part of such specifications, being them another crucial role.

When the protocol formal model is defined, its underlying characteristics are not explicit. We need to present them, precisely stating its form, and proving that they are valid in the model, i.e.\ they hold in all conceivable trace. This is the \textit{goal verification} stage, where each desired protocol feature is modeled as a goal and formal proofs build their validation to the model. Goals are divided in types, concerning the protocol property scope.

At the end, we also try to show that \textit{goal availability} is present in the model. This property provides formal guarantees to the agents that a given goal is present in that model, even under a threat model. Hence, these agents are assured that the protocol is reliably faithful to what it intends to offer.

\subsection{Reliability}
Reliability relates to how close a model is to the system it is representing. Note that such crucial property may not be really related to the security protocol goals but to the system goals itself. As a result, the number of reliability theorems may vary from a protocol to another.

However, some basic properties, which are common for many protocols, are already defined and likely to be used in new formalizations. Some of them may seem obvious, but are important for formal systems. As examples, we can cite the idempotence of \texttt{analz} operator, fresh keys and session keys proper distinction, and the certainty of messages composition correctness.

The theorems of this class are easy to prove. They mainly use induction and simplification as its main proof strategy. Providing such goals gives us assurance that our model is reliable to the real world.

\subsection{Regularity}
The regularity lemmas are facts that can be proved from any message that appears in the traffic. Such properties may be applied to specific protocol goals, but some other broader properties can be guaranteed using them.

For example, regularity lemmas hold for long-term keys which can never be sent through the channel, since they are never meant to be used over the network, just in a agent local context. Therefore, if such agent key is seen in the traffic it is easy to derive that this agent is compromised, as stated below.

\begin{center}
  \texttt{Key} (\(shrK\ A\)) \(\in \) \texttt{parts} (\(knows\) \texttt{Spy} \textit{evs}) if and only if \(A \in bad\)
\end{center}

\subsection{Confidentiality}
Holding confidentiality in a protocol can be simply translated as to preventing the disclosure of certain messages to the Spy, that is, a message \(X\) cannot belong to the Spy knowledge set. Since messages are usually protected by encryption, this property is highly related to the use of cryptographic keys.

Precisely, the confidentiality of such keys is a major issue for the protocol confidentiality, specially session keys, because if the Spy obtains them, all messages encrypted under these keys could be easily acquired and altered by her. Hence, given a key \(K\), we have to be certain that at the end of all traces the key does not belong to the Spy knowledge set, as defined below.

\begin{center}
  \(\texttt{Key}\ K \notin \texttt{analz}\ (knows\ \texttt{Spy}\ evs)\)
\end{center}

Note that if \(K\) is encrypted with some other private key of an agent, the latter cannot be part of the compromised agents set. Otherwise, the Spy could easily retrieve the key from the compromised agent, obtaining the session key and further messages. Confidentiality is also interesting for nonces, which are commonly used for assuring authenticity, computing checksum and other operations.

\subsection{Unicity}
The creation of fresh components in protocol is vastly used. It is seen in the production of session keys, nonces and other entities and they are mostly used for a single session, identifying it. Therefore, providing freshness in a protocol resembles unicity, a concept that establishes bounds between a message and its fresh components.

More precisely, if two events contain the same fresh message component, then they must be identical. Further, events containing fresh message components cannot occur more than once, otherwise they violate the unicity concept. Such lemmas are deeply explored when protocols apply the use of nonces and timestamps.

A formalization for this definition prompted the creation of a new predicate in Isabelle/HOL \textit{Auth} library, the \texttt{Unique} predicate. It takes an event and a trace as parameters, holding if the given event is unique in the given trace. Such formalization is crucial for detecting replay attacks over traces.

\subsection{Authenticity}
This property can also be read as legitimacy. In the method, the guarantee of a message's authorship is presented as synonym of integrity, since if the message is unaltered (integrity), then the authorship must be preserved. Even if the Spy intercepts the message and them relays it to the recipient, if integrity is preserved, then legitimacy is still preserved, since the Spy acted as a channel relay.

As a result, it is important that the message's author does not belong to the compromised agent set. Otherwise, any messages sent by him would be compromised as well and authenticity would not hold. Such concept may seem obvious for integrity matters, but it is important to enforce the authorship interest. Therefore, both properties are attached during our verification.

\subsection{Authentication}
As discussed in Section~\ref{sec:protocols:auth}, authentication may assume many properties. Suppose an initiator \(A\), who completes a protocol session with a responder \(B\). In this run, authentication may be translated as:

\begin{enumerate}
  \item \textbf{Aliveness of B}, meaning that \(B\) has been running the protocol;
  \item \textbf{Weak agreement of \(B\) with \(A\)}, meaning that \(B\) has been running the protocol with \(A\);
  \item \textbf{Non-injective agreement of \(B\) with \(A\) on \(H\)}, meaning a weak agreement of \(B\) with \(A\), considering the set \(H\) of message components;
  \item \textbf{Injective agreement of \(B\) with \(A\) on \(H\)}, meaning the non-injective agreement of \(B\) with \(A\), using the set \(H\) of message components, where \(B\) did not respond more than once on each session with \(A\).
\end{enumerate}

The Inductive Method does not provide formalisms to reason about the fourth point. Although, it is claimed on~\cite{Bella2007} that such formalization can be easily constructed by simple verification of repetition of a given event \textit{ev} in the analyzed trace, restraining the agents to single responses. However, the method mainly tries to provide models that are more permissive as possible, stating that any message could be repeated over traces with no harm to model.

Specifically, non-injective agreements have a wider focus. Regarding key distribution protocols, such property applied to session keys establishes a trust relation between the two agents, with a given key as a validation of such relationship, since both agents are uncompromised.

Eventually, \textbf{key distribution} becomes a major goal to be checked. Since this concept is related to the agreement of two agents in a mutual secret, it is stated in~\cite{BellareRogaway93} that this property is, indeed, stronger than authentication and thus, authentication itself relies on key distribution. Additionally, the authors of the Inductive Method prove that if authentication holds, so does key distribution, specifically non-injective agreement on a session key.

\subsection{Goal Availability}
The concept of goal availability is one of the main contributions in the work of G.~Bella~\cite{Bella2007}. In summary, it establishes a formal guarantee that the protocol model could meet a given goal and, once this is true, the validity of such goal can be applied to all peers within their assumptions. If such property holds in the model, but cannot be checked by the peers, it is argued that this goal is not available and thus, not fully assured.

Also, goal availability is closely related to the threat model considered by the protocol and its peers minimal trust. Considering the former, our adopted model is the Dolev-Yao, faithfully implemented by the Inductive Method using abstractions described in Sections~\ref{ssec:threat-model} and~\ref{ssec:operators}. If a different threat model is considered, important aspects of the model context are also altered, which may change the validity of previous goals.

\textit{Minimal trust} concerns facts that agents must assume true, due to inability to verify them, in order to check a protocol guarantee from their point of view. Precisely, agents can only verify what they send and receive from the network, having no guarantees at all about other peers. Likewise, agents cannot state if they are compromised. Therefore, they must take such facts as true, in order to establish a suitable set of clauses to attest some goal. We formally define minimal trust below.

\begin{definition}
  Let \(\mathcal{P}\) be a security protocol, \(P\) be a formal model for \(\mathcal{P}\), and \(A\) be an agent's name. The \textit{minimal trust} of \(A\) is the set of environmental facts formalized in \(P\) whose truth values \(A\) needs to know but can never verify.
\end{definition}

Having the notion of what agents can verify, an \textit{applicable guarantee} can be defined.

\begin{definition}
  Let \(\mathcal{P}\) be a security protocol, \(P\) be a formal model for \(\mathcal{P}\), and \(A\) be an agent's name. A formal guarantee in \(P\) is \textit{applicable} by \(A\) if it is established on the basis of assumptions that \(A\) is able to verify in \(P\) within her minimal trust.
\end{definition}

In these previous definitions, it is clear that guarantees that are applicable by an honest agent \(A\) are not necessarily applicable by another honest agent \(B\). Hence, this strengthens the argument that only proved assumptions concerning protocol messages, specially the ones related to the agent, are the valid formal guarantees for a given protocol goal.

Finally, the definition of available goal can be made. The principle should be used to guide the formal proofs about goals. As a result, whenever a goal is not available to some peer, it is not guaranteed at that model and so, it does not hold for the given protocol.

\begin{definition}
  Let \(\mathcal{P}\) be a security protocol, \(P\) be a formal model for \(\mathcal{P}\), \(g\) be a goal for \(\mathcal{P}\), and \(A\) be an agent's name. The goal \(g\) is \textit{available} to \(A\) in \(P\) if there exists a formal guarantee in \(P\) that confirms \(g\) and that is applicable by \(A\) in \(P\).
\end{definition}


\chapter{Classification and Prediction}

Thus far in the book, the term \emph{information}
has been used sparingly and when
it has been used, we have purposely been imprecise as to its meaning.
Although, everyone  has an intuitive feeling for what information is,
it is difficult to attach
a meaningful quantitative definition to the term. In the context of
communication systems, Claude Shannon was able to do exactly this,
and as a result, opened up an entirely new view of communication systems
analysis and design \cite[p.~123]{Albano1991}.
The principal contribution of Shannon's information theory to date has been
to allow communication theorists to establish absolute
bounds on communication systems performance that cannot be exceeded no matter
how ingeniously designed or complex our communication systems are.
Fundamental physical limitations on communication systems performance is
another topic that has been largely ignored in the preceding chapters,
but it is a subject of exceptional practical importance.
For example, for any of the numerous communication systems developed
thus far in the book, we could decide to design
a new system that would outperform the accepted standard for a particular
application. The first question that we should ask is: how close is the
present system to achieving theoretically optimum performance?
If the existing communication system operates at or near the fundamental
physical limit on performance, our task may be difficult or impossible.
However, if the existing system is far away from the absolute
performance bound, this might be an area for fruitful work.

\section{What is Classification? What is Prediction?}
\label{ch01.sec11.1}

Of course, in specifying the particular communication system under
investigation, we must know the important physical parameters,
such as transmitted
power, bandwidth, type(s) of noise present, and so on,
and information theory allows these constraints to be incorporated.
However, information theory does not provide a way for communication system
complexity to be explicitly included.
Although, this is something of a drawback, information theory itself provides
a way around this difficulty, since it is generally true that as we approach
the fundamental limit on the performance of a communication system,
the system complexity increases, sometimes quite drastically.
Therefore, for a simple communication system operating far
from its performance bound, we may be able to improve the performance
with a relatively modest increase in complexity.
On the other hand, if we have a rather complicated communication system
operating near its fundamental limit, any performance improvement may
be possible only with an extremely complicated system.

In this chapter we are concerned with the rather general block diagram
shown in Figure~\ref{ch01.fig11.1.1}. Most of the early work by
Shannon and others ignored the source  encoder/decoder blocks and
concentrated  on bounding the performance of the channel
encoder/decoder pair. Subsequently, the source  encoder/decoder blocks
have attracted much research attention.  In this chapter we consider
both topics and expose the reader to the nomenclature used in the
information theory literature.
Quantitative definitions of information are presented in
Sec.~\ref{ch01.sec11.2} that lay the foundation for the remaining
sections. In Secs.~\ref{ch01.sec11.2} and~\ref{ch01.sec11.2} we present
the fundamental source and channel coding theorems, give some examples,
and state the implications of these theorems.
Section~\ref{ch01.sec11.2} contains a brief development of rate
distortion theory,
which is the mathematical basis for data compression.
A few applications of the theory in this chapter are presented
in Sec.~\ref{ch01.sec11.2}, and a technique for variable-length
source coding is given in Sec.~\ref{ch01.sec11.2}.
\begin{equation}
x = a + b - \sqrt{q}
\end{equation}
Of course, in specifying the particular communication system under
investigation, we must know the important physical parameters,
such as transmitted
power, bandwidth, type(s) of noise present, and so on,
and information theory allows these constraints to be incorporated.
However, information theory does not provide a way for communication system
complexity to be explicitly included.
Although, this is something of a drawback, information theory itself provides
a way around this difficulty, since it is generally true that as we approach
the fundamental limit on the performance of a communication system,
the system complexity increases, sometimes quite drastically.
Therefore, for a simple communication system operating far
from its performance bound, we may be able to improve the performance
with a relatively modest increase in complexity.
On the other hand, if we have a rather complicated communication system
operating near its fundamental limit, any performance improvement may
be possible only with an extremely complicated system.

\subsection{And Yet More of the Same}

\noindent In this chapter we are concerned with the rather general block diagram
shown in Figure~\ref{ch01.fig11.1.1}. Most of the early work by
Shannon and others ignored the source  encoder/decoder blocks and
concentrated  on bounding the performance of the channel
encoder/decoder pair. Subsequently, the source  encoder/decoder blocks
have attracted much research attention.  In this chapter we consider
both topics and expose the reader to the nomenclature used in the
information theory literature.
Quantitative definitions of information are presented in
Sec.~\ref{ch01.sec11.2} that lay the foundation for the remaining
sections. In Secs.~\ref{ch01.sec11.2} and~\ref{ch01.sec11.2} we present
the fundamental source and channel coding theorems, give some examples,
and state the implications of these theorems.
Section~\ref{ch01.sec11.2} contains a brief development of rate
distortion theory,
which is the mathematical basis for data compression.
A few applications of the theory in this chapter are presented
in Sec.~\ref{ch01.sec11.2}, and a technique for variable-length
source coding is given in Sec.~\ref{ch01.sec11.2}.
\begin{itemize}
\item This is a bullet list with a short item.
\item And another item that is much longer so that we can make sure it is
formatted correctly and so forth and so on.
\item And a final short item.
\end{itemize}

\begin{figure}
\includegraphics[width=24pc]{sample-figure}
\caption{This is a caption for this figure. It is fairly long so we can make
sure it looks good when occupying more than one line. Here is one more
sentence to make it longer.}
\label{ch01.fig11.1.1}
\label{fig:query-specification}
\end{figure}

In this chapter we are concerned with the rather general block diagram
shown in Figure~\ref{ch01.fig11.1.1}. Most of the early work by
Shannon and others ignored the source  encoder/decoder blocks and
concentrated  on bounding the performance of the channel
encoder/decoder pair. Subsequently, the source  encoder/decoder blocks
have attracted much research attention.  In this chapter we consider
both topics and expose the reader to the nomenclature used in the
information theory literature.
\begin{align}
a& = b + c\\
x&= \frac{1}{2} a
\end{align}
Quantitative definitions of information are presented in
Sec.~\ref{ch01.sec11.2} that lay the foundation for the remaining
sections. In Secs.~\ref{ch01.sec11.2} and~\ref{ch01.sec11.2} we present
the fundamental source and channel coding theorems, give some examples,
and state the implications of these theorems.
Section~\ref{ch01.sec11.1} contains a brief development of rate
distortion theory,
which is the mathematical basis for data compression.
A few applications of the theory in this chapter are presented
in Sec.~\ref{ch01.sec11.2}, and a technique for variable-length
source coding is given in Sec.~\ref{ch01.sec11.2}.

Only the binary Huffman procedure has been described here,
but nonbinary codes can be designed using the Huffman method.
The details are somewhat more complicated and nonbinary codes
are less commonly encountered than binary ones,
so further discussion is left to the problems and the literature.

\section{Case Study}
\label{sec:case-study}

In this section, we exemplify how the 5S extensions for content-based image retrieval can be explored to define an image search service in the context of the CTRnet project.
The Crisis, Tragedy, and Recovery Network (CTRnet)~\cite{Balzer2007} objectives include to develop better
approaches toward making technology useful for archiving information about such events, and to support
analysis of rescue, relief, and recovery, from a digital library  perspective. CTRnet has
several modules, including crawling, filtering, a Facebook application, visualization, metadata
search, and Content-Based Image Retrieval (CBIR).

The CBIR module
builds upon the EVA tool for evaluating image descriptors for content-based image retrieval \cite{Bierman2005}. Eva integrates the most common stages of an image retrieval process and provides functionalities to facilitate the comparison of image descriptors in the context of content-based image retrieval.

In this case study, we consider the scenario in which a user is interested in finding images in the CTRnet collection that are similar to a particular photo provided as example. The objective is to identify images that could be used in a report on damages caused by an earthquake.
In this example, the query specification $q$ would be a tuple $q = (H_q, Contents_q, P_q)$, where $q$ is an image (see Figure~\ref{fig:query-specification})
 Thus, $q =
((V_q, E_q), L_q, F_q), Contents_q, P_q)$, where $V_q = {v_1}$; $E_q =\emptyset$; $L_q={' Cathedral\_P\_A\_P.jpg'}$; $F_q: V_q\cup E_q
\rightarrow L_q$, $Contents_q$ is the stream of the query image; and $P_q: V_q
\rightarrow Contents_q$.

\begin{table}
\caption{This is a little table here.}
\label{tab:coordinates}
\begin{tabular}{ccccc}
\hline
Foo& Bar& Zoo& Snork& Quux\\
\hline
 0 & 0 & 1 & 2 & 4\\
 0 & 0 & 3 & 2 & 4\\
 3 & 3 & 1 & 0 & 1\\
 3 & 1 & 4 & 2 & 1\\
 3 & 4 & 4 & 2 & 2\\
\end{tabular}
\end{table}

In this chapter we are concerned with the rather general block diagram
shown in Figure~\ref{ch01.fig11.1.1}. Most of the early work by
Shannon and others ignored the source  encoder/decoder blocks and
concentrated  on bounding the performance of the channel
encoder/decoder pair. Subsequently, the source  encoder/decoder blocks
have attracted much research attention.  In this chapter we consider
both topics and expose the reader to the nomenclature used in the
information theory literature.

\section{Entropy and Average Mutual Information}
\label{ch01.sec11.2}

Consider a discrete random variable $U$ that takes on
the values $\{u_1, u_2, \dots, u_M\}$, where the set of possible
values of $U$ is often called the \textit{alphabet} and the elements
of the set are called \textit{letters} of the alphabet. Let $P_U(u)$
denote the probability  assignment  over the alphabet, then we can
define the \textit{self-information} of the event $ u = u_j $ by
\begin{equation}
  I_U \left( u_j \right) = \log \frac{1}{P_U (u_j)} = - \log P_U
    \left( u_j \right)~.
\label{ch01.eq11.2.1}
\end{equation}
The quantity $I_U (u_j) $ is a measure  of the information  contained
in the event $ u = u_j$. Note that the base of the logarithm in
Eq.~\eqref{ch01.eq11.2.1} is unspecified. It is common
to use base $e$, in which case $I_U (\cdot) $ is in natural units (nats),
or base 2,  in which case $I_U(\cdot)$ is in binary units (bits).
Either base is acceptable since the difference in the two bases is just a
scaling operation. We will use base 2 in all of our work,
and hence $I_U(\cdot)$ and related quantities will be in bits.
The average or expected value of the self-information is called the
\textit{entropy,} also discrete entropy or absolute entropy, and is given by
\begin{equation}
 \displaystyle H(U) = - \sum^M_{j=1} P_U \left(u_j\right)
    \log P_U \left(u_j \right)~.
\label{ch01.eq11.2.2}
\end{equation}
The following example illustrates the calculation of entropy and how it is
affected by probability assignments.

\section{Exercises and Projects}
\label{cbir:exercises}

\begin{enumerate}
\item
How might CBIR be applied so teachers with a computer and connected camera can be reminded of the names of students in their class?

\item Consider the two colourful images (Image A and Image B) showed below, represented in the RGB color space. Suppose that the intensity values of each pixel in all bands (R, G, and B) are the same. Furthermore, each $(R,G,B)$ triplet is represented by a single intensity value. For example the triplet $(R,G,B)= (2,2,2)$ is represented by the intensity value $2$.

Suppose also that the colour space was quantized in five colors with intensity values 0, 1, 2, 3, and 4.

\item Compute the $L_1$ between the {\em Color Histograms} (5
  bins) of the two images. The $L_1$ distance between two color histograms $H_A$ and $H_B$ is computed as follows: $L_1(H_A, H_B) = \sum_{i=1}^{K}|H_A[i]- H_B[i]|$, where $K$ is the size of both histograms (5, in the case).

\item By considering both the feature vector extraction function and the distance function defined of the descriptor {\em Color Coherence Vector -- CCV}~\cite{Burns2006}, compute the distance
  $\delta_{CCV}(A,B)$ between the two images.

\item Consider the existence of two classes ({\em class 1} and {\em
class 2}) composed of five images each. Consider the existence of three different descriptors ({\em descriptor 1}, {\em descriptor 2}, and {\em descriptor 3}), whose feature vector extraction functions extract vectors belonging to the $R^2$ space.
Table~\ref{tab:coordinates} shows the coordinate of each image of each class, considering the three descriptors.
\end{enumerate}