Modeling Partial Attacks with Alloy

Representation of ignorance about large numbers --- agent a does not know agent b's key --- is not feasible in standard Kripke semantics. The paper introduces register models that allow for compact representation of such ignorance. This is used to design a sound an complete language for number guessing games. The probabilities generated by our semantics allow for and motivate Monte Carlo model checking for register models. We show that the approach can be extended to a real life setting, namely the analysis of cryptographic security protocols. We look at a well known security protocol for secret key distribution over an insecure network, and point out how this can be analyzed with our modified version of Kripke semantics.

With the rise of the Internet and other open networks, a large number of security protocols have been developed and deployed in order to provide secure communication. The analysis of such security protocols has turned out to be extremely difficult for humans, as witnessed by the fact that many protocols were found to be flawed after deployment. This has driven the research in formal analysis of security protocols. Unfortunately, there are no effective approaches yet for constructing correct and efficient protocols, and work on concise formal logics that might allow one to easily prove that a protocol is correct in a formal model, is still ongoing. The most effective approach so far has been automated falsification or verification of such protocols with state-of-the-art tools such as ProVerif [1] or the Avispa tools [2]. These tools have shown to be effective at finding attacks on protocols (Avispa) or establishing correctness of protocols (ProVerif).KeywordsOperational SemanticSecurity ProtocolAttack TraceComputer Security Foundation WorkshopSecurity ClaimThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

Security protocols over open networks and distributed systems: formal methods for their analysis, design, and verification

This work presents a general framework for describing cryptographic protocols and analyzing their security. The framework allows specifying the security requirements of practically any cryptographic task in a unified and systematic way. Furthermore, in this framework the security of protocols is preserved under a general composition operation, called universal composition. The proposed framework with its security-preserving composition operation allows for modular design and analysis of complex cryptographic protocols from simpler building blocks. Moreover, within this framework, protocols are guaranteed to maintain their security in any context, even in the presence of an unbounded number of arbitrary protocol sessions that run concurrently in an adversarially controlled manner. This is a useful guarantee, which allows arguing about the security of cryptographic protocols in complex and unpredictable environments such as modern communication networks.

Recent technologies have cleared the way for large scale application of electronic communication. The open and distributed nature of these communications implies that the communication medium is no longer completely controlled by the communicating parties. As a result, there has been an increasing demand for research in establishing secure communications over insecure networks, by means of security protocols. In this thesis, a formal model for the description and analysis of security protocols at the process level is developed. At this level, under the assumption of perfect cryptography, the analysis focusses on detecting aws and vulnerabilities of the security protocol. Starting from ??rst principles, operational semantics are developed to describe security protocols and their behaviour. The resulting model is parameterized, and can e.g. capture various intruder models, ranging from a secure network with no intruder, to the strongest intruder model known in literature. Within the security protocol model various security properties are de??ned, such as secrecy and various forms of authentication. A number of new results about these properties are formulated and proven correct. Based on the model, an automated veri??cation procedure is developed, which signi ??cantly improves over existing methods. The procedure is implemented in a prototype, which outperforms other tools. Both the theory and tool are applied in two novel case studies. Using the tool prototype, new results are established in the area of protocol composition, leading to the discovery of a class of previously undetected attacks. Furthermore, a new protocol in the area of multiparty authentication is developed. The resulting protocol is proven correct within the framework.

To maintain communications confidentiality, security protocols are widely used in more and more network applications. Moreover, some malwares even leverage these kinds of protocols to evade inspection by IDS. Most security protocols are designed and verified by formalized methods; however, observation shows that protocol implementations commonly contain flaws or vulnerabilities. Therefore, research on reverse engineering of security protocols can play an important role in improving the security of network applications, especially by providing another way to fight against malwares. Nevertheless, previous protocol reverse engineering technologies, which are based on analysis of network traces, encounter great challenges when the network messages transmitted between different protocol principals are encrypted. This paper proposes a taint analysis based method, which aims to infer the message format from dynamic execution of security protocol applications. The proposed approach is based on the observation that the process of message parsing in cryptographic protocol applications reveals rich information about the hierarchical structures and semantics of their messages. Hence, by observing calls to library function and instruction execution in network programs, the proposed approach can reverse derive large amount of information about their protocol, such as message format and protocol model, even the communication is encrypted. Experiments show that the reverse analysis results not only accurately identify message fields, but also unveil the structure of the encrypted message fields.

In this paper, we present a Petri net based methodology for the formal modelling and analysis of cryptographic protocols. We set up modelling rules that represent the protocols in terms of Petri nets. The modelling produces formal descriptions for the protocols with good visibility and layered abstraction. In particular, the descriptions clearly visualize the causal relations and constraints among the data flows in the protocols. An intruder model is introduced to formulate intruder attacks and to generate test cases against the cryptographic protocols. A procedure that exhaustively generates the test cases and searches for states that violate specified security criteria, is also proposed. We demonstrate the value of this methodology by applying it to a number of published protocols. In this way, we are able to reveal security flaws of these protocols. This methodology is applicable to both public-key and private-key based cryptographic protocols.

Most Petri nets-based methods that have been developed to analyze cryptographic protocols provide the analysis of one attack trace only. Only a few of them offer the analysis of multiple attack traces, but they are rather inefficient. Analogously, the limitation of the analysis of one attack trace occurs in most model checking methods for cryptographic protocols. In this paper, we propose a very simple but practical Coloured Petri nets-based model checking method for the analysis of cryptographic protocols, which overcomes these limitations. Our method offers an efficient analysis of multiple attack traces. We apply our method to two case studies which are TMN authenticated key exchanged protocol and Micali's contract signing protocol. Surprisingly, our simple method is very efficient when the numbers of attack traces and states are large. Also, we find many new attacks in those protocols.

Security protocols have been analysed using a variety of tools and focusing on a variety of properties. Most findings assume the ever so popular Dolev-Yao threat model. A more recent threat model called the Rational Attacker [1] sees each protocol participant decide whether or not to conform to the protocol upon their own cost/benefit analysis. Each participant neither colludes nor shares knowledge with anyone, a feature that rules out the applicability of existing equivalence results in the Dolev-Yao model. Aiming at mechanical validation, we abstract away the actual cost/benefit analysis and obtain the General Attacker threat model, which sees each principal blindly act as a Dolev-Yao attacker.The analysis of security protocols under the General Attacker threat model brings forward yet more insights: retaliation attacks and anticipation attacks are our main findings, while the tool support can scale up to the new analysis at a negligible price. The general threat model for security protocols based on set-rewriting that was adopted in AVISPA [2] is leveraged so as to express the General Attacker. The state-of-the-art model checker SATMC [3] is then used to automatically validate a protocol under the new threats, so that retaliation and anticipation attacks can automatically be found.KeywordsModel CheckSecurity ProtocolCryptographic ProtocolThreat ModelGeneral AttackThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

The analysis of security protocols is of great significance to ensure the safe communication of computer networks. Using formal methods to analyze security protocols has been a research hotspot in this field. Based on the run modes method and Petri net, this paper presents a specific method for analyzing security protocols. Firstly, the concepts of basic Petri net model (BPN) and attack Petri net model (APN) of protocol run modes are given, then the algorithm for constructing APN through BPN is proposed. Finally, the effectiveness of this method is illustrated by analyzing Helsinki protocol.

A method for symbolic analysis of security protocols

Security protocols (cryptographic protocol) have been widely used to not only achieve traditional goals of data confidentiality, integrity and authentication, but also secure a variety of other desired characteristics of computer-mediated transactions recently. To guarantee reliable protocols, a great deal of formal methods has been undertaken not only to develop diverse tools with specialized purpose or general purpose, but also to apply them to the analysis of realistic protocols. Many of them have been proved to be useful in detecting some intuitive attacks in security protocols. In many cases, a useful feedback is supplied to designers in order to improve the protocol’s security. For both beginners and experienced researchers, this book will present useful information on relevant technologies that can be extended or adapted. A comprehensive introduction to the basic concepts and core techniques will be presented. In this chapter, we explain what is security protocols and how they can be used to ensure secure transactions, what challenging issues in e-commerce (electronic commerce) are, why security protocol analysis important, how they are performed, and what are the ongoing efforts and relevant work. We will also explain the limitations in previous work and why it is important to develop new approaches. These questions will be briefly answered. In particular, we will focus on the discussion regarding secure transaction protocols. Finally, some emerging issues and the ways they are being met are also described.KeywordsModel CheckFormal MethodTemporal LogicSecurity ProtocolLinear Temporal LogicThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

Wireless local area networks (WLANs) are become popular as they are fast, cost effective, flexible and easy to use. There are some challenges of security and for IT administrators the choice of security protocol is a critical issue. The main motive of this paper is to make the non-specialist reader knowledgeable about threats in the wireless security and make them aware about the disadvantages of wireless security protocols. WEP (Wired Equivalent privacy), WPA (Wi-Fi Protected Access) and RSN (Robust Security Network) security protocols are defined and examined here. This security protocols are compared with the common. This paper is a comparative analysis of WEP, WPA and WPA2. We have tried to perform and check authentication of all 3 protocols by implying the legendary attack vector scripts i.e. Air crack set of tools. The test was conducted on Back Track operating system which is considered as dedicated pentesting operating system. In the test result, we found out that WEP is the weakest, to which WPA was a temporary solution and WPA2 is a very solid and long term solution. This paper is a mixture of wireless security weaknesses and counter measures to the problems faced until recently. After reading this paper the non specialist reader will have complete review and awareness about the wireless security and vulnerabilities involved with it.

The test and training enabling architecture (TENA) middleware is the result of a joint interoperability initiative of the Director, Operational Test and Evaluation (DOT&E) of the Office of the Secretary of Defense (OSD). The goals of the initiative are to enable interoperability among ranges, facilities, and simulations in a quick and cost-efficient manner, and to foster reuse of range assets and future range system developments. The TENA middleware uses Unified Modeling Language (UML)-based model-driven code generation to automatically create a complex Common Object Request Broker Architecture (CORBA) application. This model-driven automatic code-generation greatly reduces the amount of software that must be hand-written and tested. Furthermore, the TENA middleware combines distributed shared memory, anonymous publish-subscribe, and model-driven distributed object-oriented programming paradigms into a single distributed middleware system. This unique combination yields a powerful middleware system that enables its users to rapidly develop sophisticated yet understandable distributed applications. The TENA middleware offers powerful programming abstractions that are not present in CORBA alone and provides a strongly-typed application programmer interface (API) that is much less error-prone than the existing CORBA API. These high-level, easy-to-understand programming abstractions combined with an API designed to reduce programming errors enable users to quickly and correctly express the concepts of their applications. Re-usable standardized objects farther simplify the development of applications. The net result of this combination of features is a significant reduction of application programming errors yielding increased overall reliability and decreased overall development time. Distributed applications developed using the TENA middleware exchange data using the publish-subscribe paradigm. Although many publish-subscribe systems exist, the TENA middleware represents a significant advance in the field due to the many high-level, model-driven programming abstractions it presents to the programmer. The TENA middleware API relies heavily on compile-time type-safety to help ensure reliable behavior at runtime. Careful API design allows a great number of potential errors to be detected at compile-time that might otherwise go unnoticed until run-time - where the cost of an error could be extremely high! The implementation of the TENA middleware uses C++, as well as a real-time CORBA ORB. The TENA middleware is currently in use at dozens of Department of Defense (DoD) testing and training range facilities across the county and has been used to support major test and training events such as Joint Red Flag '05. The TENA Middleware is available at http://www.tena-sda.org/

We investigate conditions under which an infinite set of atomic messages can be replaced with one or two values without affecting the correctness of a security protocol. The work is conducted using the strand spaces formalism, but the results apply to all protocol analysis techniques, and should be of particular value to those using model checking.The implications of the central result are discussed.