Automated Verification of Accountability in Security Protocols

Abstract

Accountability is a recent paradigm in security protocol design which aims to eliminate traditional trust assumptions on parties and hold them accountable for their misbehavior. It is meant to establish trust in the first place and to recognize and react if this trust is violated. In this work, we discuss a protocol-agnostic definition of accountability: a protocol provides accountability (w.r.t. some security property) if it can identify all misbehaving parties, where misbehavior is defined as a deviation from the protocol that causes a security violation.We provide a mechanized method for the verification of accountability and demonstrate its use for verification and attack finding on various examples from the accountability and causality literature, including Certificate Transparency and Kroll's Accountable Algorithms protocol. We reach a high degree of automation by expressing accountability in terms of a set of trace properties and show their soundness and completeness.‚ a new definition of accountability in the single-adversary setting (which is simpler than the previous definition [25]

Analysis and Optimization of Delegation-based Sequenced Packet Exchange (SPX) Protocol: A Kailar Logic Approach

“…How relevant principals involved in the transaction keep track of the evidence of each party. For instance, the whole transaction process should be evident or transparent to all participants [7].…”

“…In this work, the author uses the Kailar Logic analysis method and techniques based on the Delegation-Based SPX protocol to prove accountability among participating principals. In this context, the primary objective of proving accountability and provability among participants within the protocol form the basis of the study [7].…”

Algorithmic Accountability in Context. Socio-Technical Perspectives on Structural Causal Models

“…Recent advances in accountability for cryptographic protocols also started to investigate the use of causal reasoning for attributing blame (e.g. Künnemann et al 2019 ). Third, accountability is discussed in the field of cloud computing, mainly focusing on data protection as well as accounting for resource usage (e.g.…”

Verifying Accountability for Unbounded Sets of Participants

“…A way of strengthening trustworthiness is to hold parties accountable for their actions, as this provides strong incentives to refrain from malicious behavior. This has lead to an increased interest in accountability in the design of security protocols.In this work, we combine the accountability definition of Künnemann, Esiyok, and Backes [22] with the notion of case tests to extend its applicability to protocols with unbounded sets of participants. We propose a general construction of verdict functions and a set of verification conditions which achieve soundness and completeness.Expressing the verification conditions in terms of trace properties allows us to extend Tamarin-a protocol verification tool-with the ability to analyze and verify accountability properties in a highly automated way.…”

“…In this work, we combine the accountability definition of Künnemann, Esiyok, and Backes [22] with the notion of case tests to extend its applicability to protocols with unbounded sets of participants. We propose a general construction of verdict functions and a set of verification conditions which achieve soundness and completeness.…”