Compositional Verification of Secure Applet Interactions

Abstract

Abstract. Recent developments in mobile code and embedded systems have led to an increased interest in open platforms, i.e. platforms which enable different applications to interact in a dynamic environment. However, the flexibility of open platforms presents major difficulties for the (formal) verification of secure interaction between the different applications. To overcome these difficulties, compositional verification techniques are required. This paper presents a compositional approach to the specification and verification of secure applet interactions. This approach involves a compositional model of the interface behavior of applet interactions, a temporal logic property specification language, and a proof system for proving correctness of property decompositions. The usability of the approach is demonstrated on a realistic smartcard case study.

Compositional Verification: Decidability Issues Using Graph Substitutions

“…They generalise 3 the concepts introduced in [4] which was inspired by [12]. In particular, this model allows us to catch security properties considered in [4], see also [12,3,18]. The ret points are the returning points of the function.…”

“…This result could actually be refined seeing that T P,m is of finite degree: this implies that it is a context-free graph. Therefore, it can be constructed as the configuration graph of a pushdown automaton (see [14]), recovering the result of [4].…”

“…The ret-labelled edges encode function returns. Any other transition of the system is labelled by τ which is called the silent action (see [4]). …”

“…This framework relies on the language-independent model of programs introduced in [12] in order to catch some classical security properties. It has been studied in [4,3,18] (see also [7]) for compositional reasoning about security of open multi-application smart cards. Like e.g.…”

“…Like e.g. [19,2,15] for concurrent systems, a proof system dealing with modal µ-calculus has been set up in [4] for the framework that we consider. But the question of decidability was left open.…”