Validating Security Protocols under the General Attacker

With the rise of the Internet and other open networks, a large number of security protocols have been developed and deployed in order to provide secure communication. The analysis of such security protocols has turned out to be extremely difficult for humans, as witnessed by the fact that many protocols were found to be flawed after deployment. This has driven the research in formal analysis of security protocols. Unfortunately, there are no effective approaches yet for constructing correct and efficient protocols, and work on concise formal logics that might allow one to easily prove that a protocol is correct in a formal model, is still ongoing. The most effective approach so far has been automated falsification or verification of such protocols with state-of-the-art tools such as ProVerif [1] or the Avispa tools [2]. These tools have shown to be effective at finding attacks on protocols (Avispa) or establishing correctness of protocols (ProVerif).KeywordsOperational SemanticSecurity ProtocolAttack TraceComputer Security Foundation WorkshopSecurity ClaimThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

Recent technologies have cleared the way for large scale application of electronic communication. The open and distributed nature of these communications implies that the communication medium is no longer completely controlled by the communicating parties. As a result, there has been an increasing demand for research in establishing secure communications over insecure networks, by means of security protocols. In this thesis, a formal model for the description and analysis of security protocols at the process level is developed. At this level, under the assumption of perfect cryptography, the analysis focusses on detecting aws and vulnerabilities of the security protocol. Starting from ??rst principles, operational semantics are developed to describe security protocols and their behaviour. The resulting model is parameterized, and can e.g. capture various intruder models, ranging from a secure network with no intruder, to the strongest intruder model known in literature. Within the security protocol model various security properties are de??ned, such as secrecy and various forms of authentication. A number of new results about these properties are formulated and proven correct. Based on the model, an automated veri??cation procedure is developed, which signi ??cantly improves over existing methods. The procedure is implemented in a prototype, which outperforms other tools. Both the theory and tool are applied in two novel case studies. Using the tool prototype, new results are established in the area of protocol composition, leading to the discovery of a class of previously undetected attacks. Furthermore, a new protocol in the area of multiparty authentication is developed. The resulting protocol is proven correct within the framework.

The analysis of security protocols is of great significance to ensure the safe communication of computer networks. Using formal methods to analyze security protocols has been a research hotspot in this field. Based on the run modes method and Petri net, this paper presents a specific method for analyzing security protocols. Firstly, the concepts of basic Petri net model (BPN) and attack Petri net model (APN) of protocol run modes are given, then the algorithm for constructing APN through BPN is proposed. Finally, the effectiveness of this method is illustrated by analyzing Helsinki protocol.

Summary form only given. Since Needham and Schroeder introduced the idea of an active attacker, a lot of research has been made on the technical side of information security in order to verify the protocols' claims against this type of attacker. Nowadays, the Dolev-Yao threat model is the most widely accepted attacker model for that. Consequently, we tend to consider systems when secure against an attacker under Dolev-Yao's assumptions. With the introduction of the human-centric security ideas we include human peers in our designs. With this addition we can potentially find and solve security flaws that were previously not detectable.In this talk, we will discuss that even though Dolev-Yao's threat model can represent the most powerful attacker possible, the attacker in this model is not realistic in certain scenarios, especially those related to the human peers. We look over other variations of threat models, including a dynamic threat model that can be adjusted according to each social-technical context. These new perspectives will help us to model and analyse security requirements in human-computer interaction always regarding to realistic scenarios without degrading security and improving usability.

A method for symbolic analysis of security protocols

Security protocols flaws are notoriously difficult to detect. Comparatively little attention has been given to logics of knowledge, although such logics have been proven to be very useful in the specifications of protocols for communication systems. We address ourselves to the analysis of security protocols under the Dolev-Yao model by using a logic of algorithmic knowledge, and propose a general method to describe formally the data structures used in the verification, such as messages, traces, intruders, and so on. We explore the use of our methodology for the verification of security protocols. The Horng-Hsu attack to Helsinki protocol has been found successfully in this setting by using SPIN.

Wireless local area networks (WLANs) are become popular as they are fast, cost effective, flexible and easy to use. There are some challenges of security and for IT administrators the choice of security protocol is a critical issue. The main motive of this paper is to make the non-specialist reader knowledgeable about threats in the wireless security and make them aware about the disadvantages of wireless security protocols. WEP (Wired Equivalent privacy), WPA (Wi-Fi Protected Access) and RSN (Robust Security Network) security protocols are defined and examined here. This security protocols are compared with the common. This paper is a comparative analysis of WEP, WPA and WPA2. We have tried to perform and check authentication of all 3 protocols by implying the legendary attack vector scripts i.e. Air crack set of tools. The test was conducted on Back Track operating system which is considered as dedicated pentesting operating system. In the test result, we found out that WEP is the weakest, to which WPA was a temporary solution and WPA2 is a very solid and long term solution. This paper is a mixture of wireless security weaknesses and counter measures to the problems faced until recently. After reading this paper the non specialist reader will have complete review and awareness about the wireless security and vulnerabilities involved with it.

We investigate conditions under which an infinite set of atomic messages can be replaced with one or two values without affecting the correctness of a security protocol. The work is conducted using the strand spaces formalism, but the results apply to all protocol analysis techniques, and should be of particular value to those using model checking.The implications of the central result are discussed.

Protocol security in a composition protocol environment has always been an open problem in the field of formal analysis and verification of security protocols. As a well-known tool to analyze and verify the logical consistency of concurrent systems, SPIN (Simple Promela Interpreter) has been widely used in the analysis and verification of the security of a single protocol. There is no special research on the verification of protocol security in a composition protocol environment. To solve this problem, firstly, a formal analysis method for composition protocol based on SPIN is proposed, and a formal description of protocol operation semantics is given. Then the attacker model is formalized, and a message specification method based on field detection and component recognition is presented to alleviate the state explosion problem. Finally, the NSB protocol and the NSL protocol are used as examples for compositional analysis. It is demonstrated that the proposed method can effectively verify the security of the protocol in a composition protocol environment and enhance the efficiency of composition protocol verification.

Many security protocols rely on the assumptions on the physical properties in which its protocol sessions will be carried out. For instance, Distance Bounding Protocols take into account the round trip time of messages and the transmission velocity to infer an upper bound of the distance between two agents. We classify such security protocols as Cyber-Physical. Time plays a key role in design and analysis of many of these protocols. This paper investigates the foundational differences and the impacts on the analysis when using models with discrete time and models with dense time. We show that there are attacks that can be found by models using dense time, but not when using discrete time. We illustrate this with a novel attack that can be carried out on most distance bounding protocols. In this attack, one exploits the execution delay of instructions during one clock cycle to convince a verifier that he is in a location different from his actual position. We propose a Multiset Rewriting model with dense time suitable for specifying cyber-physical security protocols. We introduce Circle-Configurations and show that they can be used to symbolically solve the reachability problem for our model. Finally, we show that for the important class of balanced theories the reachability problem is PSPACE-complete.

This paper proposes the improved authentication tests in order to find the potential attacks on security protocols. It is based on the authentication tests theory and enhances the original methods by introducing the notion of message type. Formalized definition of replay attacks have been integrated into the original theoretical models for further verification of security protocols. The thoroughly proof of initial and subsequent authentications in Neuman-Stubblebine protocol shows that the improved authentication tests can find flaws of the protocol more efficiently than the original ones.

Given the rapid development of systems with critical infrastructures, the chances of cyber-attacks are also growing. As the smart water distribution system is one of such structures, security concerns play a significant role in the process of designing them. This paper presents a risk analysis of smart water distribution system example architecture through threat modeling and model checking. The results of the model checking process demonstrate how security requirements can be achieved in a Security-by-Design approach.

Representation of ignorance about large numbers --- agent a does not know agent b's key --- is not feasible in standard Kripke semantics. The paper introduces register models that allow for compact representation of such ignorance. This is used to design a sound an complete language for number guessing games. The probabilities generated by our semantics allow for and motivate Monte Carlo model checking for register models. We show that the approach can be extended to a real life setting, namely the analysis of cryptographic security protocols. We look at a well known security protocol for secret key distribution over an insecure network, and point out how this can be analyzed with our modified version of Kripke semantics.

In this paper, we introduce a framework composed of a syntax and its compositional Petri net semantics, for the specification and verification of properties (like authentication) of security protocols. The protocol agents (e.g., an initiator, a responder, a server, a trusted third party, ...) are formalized as roles, each of them having a predefined behavior depending on their global and also local knowledge (including for instance public, private and shared keys), and may interact in a potentially hostile environment. The main characteristics of our framework, is that it makes explicit, structured and formal, the usually implicit information necessary to analyse the protocol, for instance the public and private contextof execution. The roles and the environment are expressed using SPL processes and compositionally translated into high-level Petri nets, while the context specifying the global and local knowledge of the participants in the protocol is used to generate the corresponding initial marking (with respect to the studied property). Finally, this representation is used to analyse the protocol properties, applying techniques of simulation and model-checking on Petri nets. The complete approach is illustrated on the case study of the Kao-Chow authentication protocol.

The automated and formal analysis of cryptographic primitives, security protocols and Application Programming Interfaces (APIs) up to date has been focused on discovering attacks that completely break the security of a system. However, there are attacks that do not immediately break a system but weaken the security sufficiently for the adversary. We term these attacks partial attacks and present the first methodology for the modeling and automated analysis of this genre of attacks by describing two approaches. The first approach reasons about entropy and was used to simulate and verify an attack on the ECB|ECB|OFB triple-mode DES block-cipher. The second approach reasons about possibility sets and was used to simulate and verify an attack on the personal identification number (PIN) derivation algorithm used in the IBM 4758 Common Cryptographic Architecture.