A Z Based Approach to Verifying Security Protocols

Formally analysing a security protocol for replay attacks

“…Based on the informal description of the protocol in Section 3 and our previous work on modelling protocols [15,16], we now specify this protocol in Object-Z.…”

“…Previously, we demonstrated the value of using the Z and Object-Z formal specification languages for verifying attacks on security protocols due to the expressive nature of these notations [15,16]. More recently, Smith and Wildman [25] showed how Z specifications can be analysed using the SAL model checker.…”

Formal verification of type flaw attacks in security protocols

“…The InTransit state schema holds the value of the message currently in transit. This is sufficient to model a single instance of a protocol consisting of sequential steps [16]. …”

“…Therefore, it would be convenient to provide a verification process for security protocols where analyses are carried out with respect to certain implementation assumptions that can be enforced in the overall development process. Attempts to apply formal verification to security protocols using formal state-based development methods such as Z [6,16], B [9], VDM, and Ina Jo [15] are rare and have not analysed protocols with complex message formats susceptible to implementation-dependent attacks. We have already demonstrated the value of a Z based approach for formal verification of security protocols [16].…”

“…Attempts to apply formal verification to security protocols using formal state-based development methods such as Z [6,16], B [9], VDM, and Ina Jo [15] are rare and have not analysed protocols with complex message formats susceptible to implementation-dependent attacks. We have already demonstrated the value of a Z based approach for formal verification of security protocols [16]. However, our abstract model did not cater for verification of implementation-dependent attacks such as type flaw attacks, which require messages to be interpreted in more than one way.…”