A Verification Framework for Stateful Security Protocols

Abstract

A long-standing research problem is how to efficiently verify security protocols with tamper-resistant global states, especially when the global states evolve unboundedly. We propose a protocol specification framework, which facilitates explicit modeling of states and state transformations. On the basis of that, we develop an algorithm for verifying security properties of protocols with unbounded state-evolving, by tracking state transformation and checking the validity of the state-evolving traces. We prove the correctness of the verification algorithm, implement both of the specification framework and the algorithm, and evaluate our implementation using a number of stateful security protocols. The experimental results show that our approach is both feasible and practically efficient. Particularly, we have found a security flaw on the digital envelope protocol, which cannot be detected with existing security protocol verifiers.

A blockchain-based decentralized booking system

“…In addition, the attacker behaviour in the current model is limited. Advanced attacker models can be defined for not only security but also privacy properties, following the style of (Dong and Muller, 2018), and the automatic verification algorithms need to be developed with respect to the attacks, for example using logic reasoning of attacks such as (Li et al ., 2017). In addition, the formal verification in this work only focuses on the application design; the implementation may introduce vulnerabilities; therefore, formal verification on the implementation is needed.…”