An intruder model with message inspection for model checking security protocols

Abstract

Model checking security protocols is based on an intruder model that represents the eavesdropping or interception of the exchanged messages, while at the same time performs attack actions against the ongoing protocol session(s). Any attempt to enumerate all messages that can be deduced by the intruder and the possible actions in all protocol steps results in an enormous branching of the model's state space. In current work, we introduce a new intruder model that can be exploited for state space reduction, optionally in combination with known techniques, such as partial order and symmetry reduction. The proposed intruder modeling approach called Message Inspection (MI) is based on enhancing the intruder's knowledge with metadata for the exchanged messages. In a preliminary simulation run, the intruder tags the analyzed messages with protocol-specific values for a set of predefined parameters. This metadata is used to identify possible attack actions, for which it is a priori known that they cannot cause a security violation. The MI algorithm selects attack actions that can be discarded, from an open-ended base of primitive attack actions. Thus, model checking focuses only on attack actions that may disclose a security violation. The most interesting consequence is a non negligible state-space pruning, but at the same time our approach also allows customizing the behavior of the intruder model, in order e.g. to make it appropriate for model checking problems that involve liveness. We provide experimental results obtained with the SPIN model checker, for the Needham Schroeder security protocol.

Model‐based design of IoT systems with the BIP component framework

“…Finally, we intend to provide support for additional nonfunctional requirements related to energy consumption() and security aspects. For the latter, it has been planned to extend the design flow with BIP components that model the security mechanisms of the Contiki OS for being able to identify vulnerabilities and verify the IoT system's protection against node spoofing attacks and denial of service attempts. In another perspective, it is worth to consider using the secure BIP extension as a means for the analysis and synthesis of security configurations in IoT applications that can ensure data and event noninterference…”

Formal validation of the security properties of AMT's three-way handshake

“…A -> S: {Kab}_Kas S -> B: {Kab}_Kbs [18]. Support for other intruder models such as algebraic intruder model [11], message-based inspection model [7], and multiagent based systems semantics [25], can be integrated with AVISPA's communication channel in the future [30]. AVISPA's selection of this model is supported by the fact that this model can emulate the actions of an arbitrary adversary [12], and it is also very challenging because it gives advantage to the intruder as opposed to other models [12].…”

Correct by construction model based design for systems and software

“…Considering the proposed flow for IoT systems, we intend to provide support for additional extra-functional requirements, related to energy consumption [136], [153] and security aspects. For the latter, it has been planned to extend the design flow with BIP components that model security mechanisms of the Contiki OS [154], for being able to identify vulnerabilities and verify the IoT system's protection against malicious attacks, such as node spoofing [155] and denial of service [156].…”