Integrating Automated and Interactive Protocol Verification

Abstract

Abstract. A number of current automated protocol verification tools are based on abstract interpretation techniques and other over-approximations of the set of reachable states or traces. The protocol models that these tools employ are shaped by the needs of automated verification and require subtle assumptions. Also, a complex verification tool may suffer from implementation bugs so that in the worst case the tool could accept some incorrect protocols as being correct. These risks of errors are also present, but considerably smaller, when using an LCF-style theorem prover like Isabelle. The interactive security proof, however, requires a lot of expertise and time. We combine the advantages of both worlds by using the representation of the over-approximated search space computed by the automated tools as a "proof idea" in Isabelle. Thus, we devise proof tactics for Isabelle that generate the correctness proof of the protocol from the output of the automated tools. In the worst case, these tactics fail to construct a proof, namely when the representation of the search space is for some reason incorrect. However, when they succeed, the correctness only relies on the basic model and the Isabelle core.

Strong Invariants for the Efficient Construction of Machine-Checked Protocol Security Proofs

“…A recent approach by Brucker and Mödersheim for automatic generation of machine-checkable proofs is described in [12]. They use the OFMC model checker [34] to compute a fixpoint of an abstraction of the transition relation of the protocol P of interest.…”

“…The time needed to generate and machine-check proofs is orders of magnitude faster than the results for the automatic generation of machine-checked proofs reported in [12], [13]. Moreover, the resulting framework, comprising both our Isabelle/HOL protocol theory and the proof-generation algorithm, is the first framework that combines the benefits of manual (machine-checkable) proof construction with the efficiency of automatic protocol verification.…”

A BSP algorithm for on-the-fly checking CTL* formulas on security protocols

“…If σ has not been found False, and if σ is in the stack (meaning that its SCC is still being constructed), the σ and σ will be in the same SCC: we reflect this by updating σ .low accordingly. We also update σ .valid by removing formulas whose starting points occur after σ ; as we show below, these formulas cannot be used as evidence for the success of the SCC containing σ and σ (lines [8][9][10][11][12][13][14]. Once the subgoal processing is completed, loop ltl checks to see whether a new SCC component has been detected; if no, it removes it from the stack (lines [18][19][20][21][22][23] and finally backtracks to the parent call (line 25).…”

Efficient construction of machine-checked symbolic protocol security proofs

“…This tool can be seen as a re-implementation of the Scyther tool [15], extending it with support for proof-generation and verification in an untyped protocol model. Compared to the other two existing approaches for the automatic generation of machine-checked protocol security proofs [13,23], our approach is orders of magnitude faster than [13] and as fast as [23], but more expressive with respect to the security properties supported. Moreover, the Isabelle/HOL formalization of our theory and the proof-generation algorithm constitute the first framework that combines the benefits of manual, machine-checkable, proof construction with the efficiency of automatic protocol verification.…”

“…Brucker and Mödersheim describe an approach for the automatic generation of machine-checkable proofs in [13]. They use the OFMC model checker [33] to compute a fixpoint of an abstraction of the transition relation of the protocol P of interest.…”