Formal Models and Techniques for Analyzing Security Protocols: A Tutorial

Abstract

International audienceSecurity protocols are distributed programs that aim at securing communications by the means of cryptography. They are for instance used to secure electronic payments, home banking and more recently electronic elections. Given The financial and societal impact in case of failure, and the long history of design flaws in such protocol, formal verification is a necessity. A major difference from other safety critical systems is that the properties of security protocols must hold in the presence of an arbitrary adversary. The aim of this paper is to provide a tutorial to some modern approaches for formally modeling protocols, their goals and automatically verifying them

Relating Process Languages for Security and Communication Correctness (Extended Abstract)

“…Indeed, research on security extensions to behavioral types (cf. the survey [2]) seems to have proceeded independently from approaches such as those overviewed in [7]. The work in [6] is similar in spirit to ours, but is different in conception and details, as it uses a session graph specification to generate a cryptographic functional implementation that enjoys session integrity.…”

“…They are representative of two separate research strands: (a) Process models for security protocols, such as [12] (see also [7]), rely on variants of the applied π-calculus [1] to establish properties related to process execution (e.g., secrecy and confidentiality). These models support cryptography and term passing, but lack support for high-level communication structures.…”

Automated type-based analysis of injective agreement in the presence of compromised principals

“…In addition to type checkers and type systems, there are other tools and techniques that can be utilized for the formal analysis of security protocols, each has its own pros and cons [45,46]. The inductive method [47] is among the first solutions proposed to verify security protocols.…”

Security and Privacy of Protocols and Software with Formal Methods

“…[15,27,34] The approach to secure such a complex system is the modelization of security protocols with formal languages, and of the security properties to be preserved with formal logics. This formalization effort allows us to produce automated techniques and tools that verify whether the protocols and their implementations respect the security requirements.…”