Automated Logic-Based Technique for Formal Verification of Security Protocols

Abstract

 Abstract-The design of secure protocols is complex and prone to error. Formal verification is an imperative step in the design of security protocols and provides a rigid and thorough means of evaluating the correctness of security protocols. This paper discusses the process of formal verification using a logic-based technique for detecting protocol weaknesses that are exploitable by freshness and interleaving attacks. This technique is realised as a special purpose logic for attack detection that can be used throughout the design stage, i.e. it subjects a draft of a protocol to formal analysis prior to its publication or deployment. For any detected failure the analysis will also reveal reasons for the weaknesses, facilitating design corrections. A summary of the attack detection logic is presented and its ability to detect weaknesses is demonstrated by applying it to a smart-card based authentication protocol. Further, a prototype implementation of the attack detection logic theory is introduced. An empirical study is presented that assesses the effectiveness and efficiency of the proposed automated technique by applying it to a set of protocols, incorporating some with known vulnerabilities and some that are known to be secure. This study confirms the ability of the technique to detect all design weaknesses. Additionally, it establishes the efficiency of the verification technique, in terms of memory requirements (study was carried out on a computing platform of 2GB of RAM) and execution times (milliseconds) required for protocol verification. Index Terms-Attacks, formal verification, logic-based verification tool security protocols. I. INTRODUCTIONThe security of electronic networks and information systems is a critical issue for the use of new technologies in many fields of life. The massive growth in communications, in particular in the wireless sector and internet of things, causes an ever changing environment for today"s communication services. Security protocols are required to ensure the security of both the communications infrastructure itself and the information that runs through it. Designing error-free security protocols that are impervious to attack techniques, such as freshness and interleaving sessions (i.e. impersonation attacks, man-in-the-middle attacks, oracle attacks, multiplicity attacks and other types of parallel session attacks) is an extremely challenging task [1]. The challenge comes mainly from the difficulty of foreseeing all possible operative scenarios of an attacker, which can include concurrent execution of several protocol sessions and various different attack strategies. For example, in a freshness attack the adversary uses components of the messages from previous

Security Considerations for Internet of Things: A Survey

“…Moreover, the design of such protocols should be robust enough to resist attacks [70,71,74] and must be tested for their functional correctness (i.e. application of formal method) before they are used in practice [69,86].…”

Detection and Prevention of New Attacks for ID-based Authentication Protocols

“…However, a public network such as the Internet should be treated as an insecure network, where a malicious adversary can eavesdrop, intercept and modify messages. Thus, cryptographic protocols are required to ensure the security of both the infrastructure itself and the information that runs through it [1,2]. Basic security protocols allow agents to authenticate each other, to establish fresh session keys for confidential communication and to ensure the authenticity of data and services.…”

Detecting Abnormal Traffic in Large-Scale Networks

“…For example, $350M and $70M are the size of loss caused by Yahoo and Bitcoin data breach, respectively [1]. The intruder techniques have been evolved using sophisticated tools to create attacks, exploiting vulnerabilities in server protocols [2], [3].…”