A Methodology for Protocol Verification Applied to EMV® 1

Abstract

The EMVCo 3 organisation (i.e. MasterCard, Visa, etc.) protocols facilitate worldwide interoperability of secure electronic payments. Despite recent advances, it has proved difficult for academia to provide an acceptable solution to construction of secure applications within industry's constraints. In this paper, we describe a methodology we have applied to EMV1. It involves domain specific languages and verification tools targeting different analysis of interest. We are currently collaborating with EMVCo on their upcoming EMV R 2 nd Generation (EMV2) specifications.

Security Analysis of the Open Banking Account and Transaction API Protocol

“…It should be noted that the AnBx compiler [15] also enables Java code generation, which can be deployed to further experiment with the protocol. Thus, we argue our methodology [8] can be an effective approach to help design and develop reliable safety/security-critical protocols.…”

“…The formal verification of Open Banking API presented in this work is based on a protocol verification methodology proposed in [8]. The methodology utilises the Alice and Bob notation (AnB) [12] to specify a formal model of the protocol that can be formally verified through information flow (secrecy and authenticity) goals.…”

“…Contribution In this paper, we present a formal security analysis of the Open Banking Standard APIs, focusing on the verification of the correctness of the Account and Transaction API protocol. The work relies on a previously proposed methodology [8] which provided a practical approach to protocol modelling and verification. The methodology utilises the Alice and Bob notation (AnB) [12] to specify a formal model of the protocol that can be formally verified with the OFMC model checker [3], which has been used to model and verify a significant number of security protocols, for example a projects like AVANTSSAR [2].…”

Account and Transaction Protocol of the Open Banking Standard

“…The formal verification of Open Banking API presented in this work is based on a protocol verification methodology proposed in [5]. The methodology utilises the Alice and Bob notation (AnB) [9] to specify a formal model of the protocol that can be formally verified through information flow (secrecy and authenticity) goals.…”

“…In this paper, we present an overview of a formal security analysis of the Open Banking Standard APIs, focusing on the verification of the correctness of the Account and Transaction API protocol. The work relies on a previously proposed methodology [5] which provided a practical approach to protocol modelling and verification. The methodology utilises the Alice and Bob notation (AnB) [9] to specify a formal model of the protocol that can be formally verified with the OFMC model checker [2].…”