Automatic verification of secrecy properties for linear logic specifications of cryptographic protocols

This article aims to generate all theorems of a given size in the implicational fragment of propositional intuitionistic linear logic. It was presented at the 36th International Conference on Logic Programming (ICLP).

Security protocols over open networks and distributed systems: formal methods for their analysis, design, and verification

Security protocols ensure secure communication between and within systems such as internet services, factories, and smartphones. As evidenced by numerous successful attacks against popular protocols such as TLS, designing protocols securely is a tedious and error-prone task. Model checkers greatly aid protocol verification, yet any single model checker is oftentimes insufficient to check a protocol's security in full. Instead, engineers are forced to maintain multiple overlapping and hopefully non-contradicting and non-diverging specifications, one per model-checking tool---an error-prone task.To address this problem, this paper presents VICE, a scenario-based approach to security-protocol verification. It provides a visual modeling language based for specifying security protocols independent of the model checker. It then automatically transforms the relevant fragments of these models into equivalent inputs to multiple model checkers. In result, VICE completely relieves the security engineer from choosing and specifying queries via a fully automatic generation of all necessary queries.Through a case study involving real-world specifications of eight security protocols, we show that VICE is applicable in practice.

Given recent high-profile successes in formal verification of security-related properties (e.g., for seL4), and the rising popularity of applying formal methods to cryptographic libraries and security protocols like TLS, we revisit the meaning of security-related proofs about software. We re-examine old issues, and identify new questions that have escaped scrutiny in the formal methods literature. We consider what value proofs about software systems deliver to end-users (e.g., in terms of net assurance benefits), and at what cost in terms of side effects (such as changes made to software to facilitate the proofs, and assumption-related deployment restrictions imposed on software if these proofs are to remain valid in operation). We consider in detail, for the first time to our knowledge, possible relationships between proofs and side effects. To make our discussion concrete, we draw on tangible examples, experience, and the literature.

This paper discusses the decision problem concerning security for such cryptographic protocols as the cryptographic key distribution protocols and the digital signature protocols. A cryptographic protocol and its utilization environment are considered secure if an opponent cannot know the secret message or forge a signature successfully by wiretapping or communication function is secure. This paper presents a sufficient condition under which the security problem is decidable. Dolev et al. also investigated the decision problem of the security, but they discussed only the simple case where the cryptographic key is not the object of manipulation (i.e., key generation and distribution are not included in the protocol), and a decision method is presented in which the decision can be made in a polynomial time. By contrast, this paper discusses the problem including the case where the cryptographic key can be an object of manipulation. The key delivery protocol by Ehrsam et al. and the digital signature protocol by Needham et al. satisfy the sufficient condition for the decidability given in this paper. Under the sufficient condition given in this paper, the security can again be decided in a polynomial time.

Recent development of logic programming languages based on linear logic suggests a successful direction to extend logic programming to be more expressive and more efficient. The treatment of formulasas-resources gives us not only powerful expressiveness, but also efficient access to a large set of data. However, in linear logic, whole resources are kept in one context, and there is no straight way to represent complex data structures as resources. For example, in order to represent an ordered list and time-dependent data, we need to put additional indices for each resource formula. This paper describes a logic programming language, called TLLP, based on intuitionistic temporal linear logic. This logic, an extension of linear logic with some features from temporal logics, allows the use of the modal operators '?'(next-time) and '?'(always) in addition to the operators used in intuitionistic linear logic. The intuitive meaning of modal operators is as follows: ? B means that B can be used exactly once at the next moment in time; ? B means that B can be used exactly once any time; !B means that B can be used arbitrarily many times (including 0 times) at any time. We first give a proof theoretic formulation of the logic of the TLLP language. We then present a series of resource management systems designed to implement not only interpreters but also compilers based on an extension of the standard WAM model.

This paper discusses a Unified Modelling Language (UML) based formal verification methodology for early error detection in the model-based software development cycle. Our approach proposes a UML-based formal verification process utilising functional and behavioural modelling artifacts of UML. It reinforces these artifacts with formal model transition and property verification. The main contribution is a UML to Labelled Transition System (LTS) Translator application that automatically converts UML Statecharts to formal models. Property specifications are derived from system requirements and corresponding Computational Tree Logic (CTL)/Linear Temporal Logic (LTL) model checking procedure verifies property entailment in LTS. With its ability to verify CTL and LTL specifications, the methodology becomes generic for verifying all types of embedded system behaviours. The steep learning curve associated with formal methods is avoided through the automatic formal model generation and thus reduces the reluctance of using formal methods in software development projects. A case study of an embedded controller used in military applications validates the methodology. It establishes how the methodology finds its use in verifying the correctness and consistency of UML models before implementation.

We report on a case study in applying different formal methods to model and verify an architecture for administrating digital signatures. The architecture comprises several concurrently executing systems that authenticate users and generate and store digital signatures by passing security relevant data through a tightly controlled interface. The architecture is interesting from a formal-methods perspective as it involves complex operations on data as well as process coordination and hence is a candidate for both data-oriented and process-oriented formal methods.We have built and verified two models of the signature architecture using two representative formal methods. In the first, we specify a data model of the architecture in Z that we extend to a trace model and interactively verify by theorem proving. In the second, we model the architecture as a system of communicating processes that we verify by finite-state model checking. We provide a detailed comparison of these two different approaches to formalization (infinite state with rich data types versus finite state) and verification (theorem proving versus model checking). Contrary to common belief, our case study suggests that Z is well suited for temporal reasoning about process models with complex operations on data. Moreover, our comparison highlights the advantages of proving theorems about such models and provides evidence that, in the hands of an experienced user, theorem proving may be neither substantially more time-consuming nor more complex than model checking.

Encryption as an abstract data-type: An extended abstract

Modalities for model checking: branching time logic strikes back

Cryptographic protocols, which are also referred to as security protocols are used to process, store and transfer increasing volumes of information on our financial networks, health networks, and even our library systems, not to mention our conventional communication systems and our networked systems of personal and corporate computers. Users should be able to justifiably rely on their implementations to process, store, and communicate sensitive information securely. Testing is indispensable even when a security protocol is formally verified because most formal verification techniques only guarantee the correctness of the design, under certain assumptions. More importantly, no guarantees about the implementation are provided. A mathematical proof that an implementation of a security protocol conforms to its specifications is usually not feasible because it would require complicated formal semantics of the language in which it is written and the environment in which the protocol runs (the operating system and hardware)

SAT-based bounded model checking (BMC) has been introduced as a complementary technique to BDD-based symbolic model checking in recent years, and a lot of successful work has been done in this direction. The approach was first introduced by A. Biere et al. in checking linear temporal logic (LTL) formulae and then also adapted to check formulae of the universal fragment of computation tree logic (ACTL) by W. Penczek et al. As the efficiency of model checking is still an important issue, we present an improved BMC approach for ACTL based on Penczek's method. We consider two aspects of the approach. One is reduction of the number of variables and transitions in the k-model by distinguishing the temporal operator EX from the others. The other is simplification of the transformation of formulae by using uniform path encoding instead of a disjunction of all paths needed in the k-model. With these improvements, for an ACTL formula, the length of the final encoding of the formula in the worst case is reduced. The improved approach is implemented in the tool BMV and is compared with the original one by applying both to two well known examples, mutual exclusion and dining philosophers. The comparison shows the advantages of the improved approach with respect to the efficiency of model checking.

1.1 Relationship between Petri net and linear logic Petri nets were first introduced by Petri in his seminal Ph.D. thesis, and both the theory and the applications of his model have flourished in concurrency theory (Reisig & Rozenberg, 1998a; Reisig & Rozenberg, 1998b). The relationships between Petri nets and linear logics have been studied by many researchers (Engberg & Winskel, 1997; Farwer, 1999; Hirai, 2000; Hirai 1999; Ishihara & Hiraish, 2001; Kamide, 2004, Kamide, 2006; Kanovich, 1995; Kanovich 1994; LarcheyWendling & Galmiche, 1998; Larchey-Wendling & Galmiche, 2000; Lilius, 1992; Mart -Oliet & Meseguer, 1991; Okada, 1998; Tanabe, 1997). A category theoretical investigation of such a relationship was given by Mart -Oliet and Meseguer (Mart -Oliet & Meseguer, 1991), purely syntactical approach using Horn linear logic was established by Kanovich (Kanovich, 1995; Kanovich 1994), a naive phase linear logic for a certain class of Petri nets was given by Okada (Okada, 1998), a linear logical view of object Petri nets were studied by Farwer (Farwer, 1999), and various Petri net interpretations of linear logic using quantale models were obtained by Ishihara and Hiraishi (Ishihara & Hiraish, 2001), Engberg and Winskel (Engberg & Winskel, 1997), Larchey-Wendling and Galmiche (Larchey-Wendling & Galmiche, 1998; Larchey-Wendling & Galmiche, 2000), and Lilius (Lilius, 1992). Petri net interpretations using Kripke semantics for various fragments and extensions of intuitionistic linear logic were studied by Kamide (Kamide, 2004; Kamide, 2006c). In (Kamide, 2004), Petri net interpretations of various fragments of a spatio-temporal soft linear logic were discussed. In (Kamide, 2006c), Petri nets with inhibitor arcs, which were first introduced by Kosaraju (Kosaraju, 1973) to show the limitation of the usual Petri nets, were described using Kripke semantics for intuitionistic linear logic with strong negation. The approarches using Kripke semantics can obtain a very simple correspondence between Petri net and linear logic.

RTCA DO-333, Formal Methods Supplement to DO-178C and DO-278A, provides guidance for software developers wishing to use formal methods in the certification of airborne systems and air traffic management systems. This paper presents three case studies describing the use of different classes of formal methods to satisfy DO-178C certification objectives. The case studies examine different aspects of a common avionics example, a dual-channel Flight Guidance System (FGS), which is representative of the issues encountered in actual developments. The three case studies illustrate the use of theorem proving, model checking, and abstract interpretation. Each of these techniques has strengths and weaknesses and each could be applied to different life cycle data items and different objectives than those described here. Our purpose is to illustrate a reasonable application of each of these techniques to produce the evidence needed to satisfy certification objectives in a realistic avionics application. We hope that these case studies will be useful to industry and government personnel in understanding formal methods and the benefits they can provide.

Bounded model checking (BMC) is an attractive alternative to symbolic model checking, since it often allows a more efficient verification. The idea of BMC is to reduce the model checking problem to a satisfiability problem of the underlying base logic, so that sophisticated decision procedures can be utilized to check the resulting formula. We present a new approach to BMC that extends current methods in three ways: First, instead of a reduction to propositional logic which restricts BMC to finite state systems, we focus on infinite state systems and therefore consider more powerful, yet decidable base logics. Second, instead of directly unwinding temporal logic formulas, we use special translations to ?-automata that take into account the temporal logic hierarchy and maintain safety and liveness properties. Third, we employ both global and local model checking procedures to take advantage of the different types of specifications that can be handled by these techniques. Based on three-valued logic, our bounded model checking procedures may either prove or disprove a specification, or they may explicitly state that no information has been obtained due to insufficient bounds.