A Conference Management System with Verified Document Confidentiality

Kanav, Sudeep; Lammich, Peter; Popescu, Andrei

doi:10.1007/978-3-319-08867-9_11

Cited by 29 publications

(20 citation statements)

References 27 publications

(30 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Smaller relations B mean that an observer may deduce some information about the secrets, but nothing beyond B-for example, if B is an equivalence relation, then the observer may deduce the equivalence class, but not the concrete secret within the equivalence class. The original formulation of BD security in [18] includes an additional parameter T, a declassification trigger: The above condition is only required to hold for traces tr where T does not occur. Hence, as soon as the trigger occurs, the security property no longer offers any guarantees.…”

Section: Bd Security Recalledmentioning

confidence: 99%

“…In our case studies, we assume the observers to be users of the system, and our goal is to verify that, by interacting with the system, the observers cannot learn more about confidential information than what we have specified. As a first case study, we have developed CoCon [18], a conference system (à la EasyChair) verified for confidentiality. We have verified a comprehensive list of confidentiality properties, systematically covering the relevant sources of information from CoCon's application logic [18, §4.5].…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

CoSMed: A Confidentiality-Verified Social Media Platform

Bauereiss

Gritti²,

Popescu

et al. 2016

Interactive Theorem Proving

Self Cite

View full text Add to dashboard Cite

Abstract. This paper describes progress with our agenda of formal verification of information-flow security for realistic systems. We present CoSMed, a social media platform with verified document confidentiality. The system's kernel is implemented and verified in the proof assistant Isabelle/HOL. For verification, we employ the framework of Bounded-Deducibility (BD) Security, previously introduced for the conference system CoCon. CoSMed is a second major case study in this framework. For CoSMed, the static topology of declassification bounds and triggers that characterized previous instances of BD security has to give way to a dynamic integration of the triggers as part of the bounds.

show abstract

Section: Bd Security Recalledmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

CoSMed: A Confidentiality-Verified Social Media Platform

Bauereiss

Gritti²,

Popescu

et al. 2016

Interactive Theorem Proving

Self Cite

View full text Add to dashboard Cite

show abstract

“…Their work has been recently extended to support any cloud-based system such as public tender management and recruitment process. Kanav et al [17] introduce CoCon, a formally verified implementation of conference management system that guarantees confidentiality. All of the mentioned systems, however, assume trusted managers.…”

Section: Related Workmentioning

confidence: 99%

A Secure Exam Protocol Without Trusted Parties

Bella¹,

Giustolisi²,

Lenzini³

et al. 2015

ICT Systems Security and Privacy Protection

View full text Add to dashboard Cite

Abstract. Relying on a trusted third party (TTP) in the design of a security protocol introduces obvious risks. Although the risks can be mitigated by distributing the trust across several parties, it still requires at least one party to be trustworthy. In the domain of exams this is critical because parties typically have conflicting interests, and it may be hard to find an entity who can play the role of a TTP, as recent exam scandals confirm. This paper proposes a new protocol for paper-based and computer-based exams that guarantees several security properties without the need of a TTP. The protocol combines oblivious transfer and visual cryptography to allow candidate and examiner to jointly generate a pseudonym that anonymises the candidate's test. The pseudonym is revealed only to the candidate when the exam starts. We analyse the protocol formally in ProVerif and prove that it satisfies all the stated security requirements.

show abstract

“…Programs can be written and verified in Isabelle/HOL, and efficient code for them (in Haskell, Standard ML, OCaml and Scala) can be produced using a code generator [19]. This certified programming methodology has yielded a wide range of verified software systems, from a Java compiler [32] to an LTL model checker [14] to a conference management system [23]. The formal guarantees of all such systems, as well as those considered by some formal certification agencies [21], are based on one major assumption: the correctness/consistency of Isabelle/HOL's inference engine.…”

Section: Introductionmentioning

confidence: 99%

Comprehending Isabelle/HOL’s Consistency

KunăźAr¹,

Popescu²

2017

Programming Languages and Systems

Self Cite

View full text Add to dashboard Cite

Abstract. The proof assistant Isabelle/HOL is based on an extension of HigherOrder Logic (HOL) with ad hoc overloading of constants. It turns out that the interaction between the standard HOL type definitions and the Isabelle-specific ad hoc overloading is problematic for the logical consistency. In previous work, we have argued that standard HOL semantics is no longer appropriate for capturing this interaction, and have proved consistency using a nonstandard semantics. The use of an exotic semantics makes that proof hard to digest by the community. In this paper, we prove consistency by proof-theoretic means-following the healthy intuition of definitions as abbreviations, realized in HOLC, a logic that augments HOL with comprehension types. We hope that our new proof settles the Isabelle/HOL consistency problem once and for all. In addition, HOLC offers a framework for justifying the consistency of new deduction schemas that address practical user needs.

show abstract

A Conference Management System with Verified Document Confidentiality

Cited by 29 publications

References 27 publications

CoSMed: A Confidentiality-Verified Social Media Platform

CoSMed: A Confidentiality-Verified Social Media Platform

A Secure Exam Protocol Without Trusted Parties

Comprehending Isabelle/HOL’s Consistency

Contact Info

Product

Resources

About