Formal prototyping in early stages of protocol design

Abstract

Network protocol design is usually an informal process where debugging is based on successive iterations of a prototype implementation. The feedback provided by a prototype can be indispensable since the requirements are often incomplete at the start. A drawback of this technique is that errors in protocols can be notoriously difficult to detect by testing alone. Applying formal methods such as theorem proving can greatly increase one's confidence that the protocol is correct. However, formal methods can be tedious to use, rarely support successive design iterations and prototyping, are difficult to scale to entire designs, and typically require a clear understanding of requirements in advance. We investigate how formal simulation based on Maude executable specifications overcomes many of these hurdles. We apply this technique in the early stages of the design of a new security protocol, known as Layer 3 Accounting (L3A), aimed at protecting known vulnerabilities in the wireless accounting infrastructure. The protocol sets up a collection of IPsec security associations that provide the necessary protection. We demonstrate how formal simulation uncovered problems in several successive iterations of the L3A protocol design.

Formal Analysis of Time-Dependent Cryptographic Protocols in Real-Time Maude

“…If the attack is not found, then the search or model checking command is repeated for the maxActions/duration-pair (2, 4). And so the process continues with the pairs (3, 3), (2,5), (3,4), (4,3), (2,6), . .…”

“…Another advantage of our approach compared to using domain-specific crypto-analysis tools is that we can include the cryptographic protocol as a part of a larger system, or in combination with other kinds of protocols, and that we can model much larger and complex protocols for which Maude has proved useful in the untimed setting [5]. Furthermore, our tool allows simulation for prototyping purposes, and provides expressive analysis features to allow model checking of a wide range of properties beyond just reachability properties.…”

A Program Logic for Verifying Secure Routing Protocols

“…There has been a large body of work on verifying the correctness of various network protocol design and implementations using proof-based and model-checking techniques [5,16,13]. The program logic presented here is customized to proving safety properties of SANDLog programs, and may not be expressive enough to verify complex correctness properties.…”

Analyzing BGP Instances in Maude

“…In addition to our use of Maude for analyzing BGP instances, there is also a huge literature of using Maude for other complex systems, such as security protocols [11] , real-time systems [20], and active networking [5].…”