Cryptographic Protocol Synthesis and Verification for Multiparty Sessions

Abstract

We present a compiler for generating custom cryptographic protocols from high-level multiparty sessions.Sessions specify pre-arranged patterns of message exchanges between distributed participants and their data accesses to a shared store. We define integrity and confidentiality properties of sessions, in a setting where the network and arbitrary compromised parties may be controlled by an adversary. Our compiler enforces these security properties by guarding the sending and receiving of session messages by efficient cryptographic operations and checks.Given a session, our compiler generates an ML module and an interface that exposes send and receive functions that can be called by application code for each party. We prove that this generated code is secure by relying on a recent refinement type system for ML. Functions in the module interface are given dependent types that express invariants of the session state. We typecheck the program against this interface, and complete the proof by a brief, handcrafted argument.We illustrate and evaluate our implementation on a series of typical protocols, inspired by web services. In comparison with prior work, our source language is more expressive, our implementation more efficient, and our proof technique novel. Most of the proof is performed by mechanized type checking of the generated code, and does not rely on the correctness of our compiler. We obtain the strongest session security guarantees to date in a model that accounts for the actual details of protocol code. Security by compilationTaking advantage of modern programming tools and generic wire formats, one can sometimes design, develop, and deploy complex distributed protocols in a matter of hours-relying on automated proxy generators, for example, to rapidly expose existing applications as networked services. The situation is less favorable when attempting to ensure application security subject to realistic assumptions on the network and remote parties. The problem is that most widely-available protocols for cryptographic communications (say TLS or IPSEC) operate at a lower level; they provide authenticity and confidentiality guarantees only for messages exchanged between two endpoints (URLs or IP addresses), but they leave the interpretation of these messages and endpoints to the application programmer. Hence, any guarantee that involves more than two parties (say, a multi-tiered web application with a client, a gateway, and two servers) must be carefully established by linking lowerlevel guarantees on related messages, or by layering ad hoc cryptographic mechanisms on top of communications, for instance by embedding certificates in message payloads.When considering protocols between participants in an open, networked environment, each participant may belong to a different domain, with its own configuration and security policy; although all participants are willing to run the protocol, they may not trust one another. Although it is straightforward to protect the participants of the protocol from netw...

Session Types for Access and Information Flow Control

“…This process is insecure because, depending on the high value received for x on channel s [2], that is, on whether the Q-set is H 1 or H 2 , the low value true ⊥ will be emitted or not on channel s [3], leading to…”

Security Goals and Protocol Transformations

“…Some start with a crypto-free protocol, and transform it into a protocol meeting security goals [9,4]. Others transform a protocol secure in a weak adversary model into protocols satisfying those goals with multi-session, active adversary [20].…”

A Multiparty Multi-session Logic

“…Our theory, based on multiparty sessions, can verify processes against a contract globally agreed by multiple distributed peers. [2] uses refinement types for channels to verify authentication in multiparty session protocols, but does not consider multi-session properties. The work [7] investigates a relationship between a dual intuitionistic linear logic and binary session types, and shows that the former defines a proof system for a session calculus which can automatically characterise and guarantee a session fidelity and global progress.…”

“…Types offer a stable linkage between the fundamental dynamics of programs and their mathematical abstractions, serving as a highly effective basis for safety assurance. In the context of process algebras, approaches like [5,13,18] allow tractable 2 (e.g., with respect to model checking techniques) validation of properties such as session fidelity, progress, and error freedom. Furthermore, they enable the specification of global properties of multiparty interactions, yet enabling modular local verification of each principal.…”

“…The principals within the OOI infrastructure perform interactive activities involving distributed resources, e.g., remote instruments, off-shore sensors, data. It is important to: (1) ensure that the principals carry out each activity (session) in a way that conform a well-defined protocol, (2) express properties that span the single activities (e.g., associate each principal with a credit for resource usage, and ensure that this will always be non negative across sessions 1 ).…”