Modeling and Verifying Physical Properties of Security Protocols for Wireless Networks

Abstract

We present a formal model for modeling and reasoning about security protocols. Our model extends standard, inductive, trace-based, symbolic approaches with a formalization of physical properties of the environment, namely communication, location, and time. In particular, communication is subject to physical constraints, for example, message transmission takes time determined by the communication medium used and the distance traveled. All agents, including intruders, are subject to these constraints and this results in a distributed intruder with restricted, but more realistic, communication capabilities than those of the standard Dolev-Yao intruder. We have formalized our model in Isabelle/HOL and used it to verify protocols for authenticated ranging, distance bounding, and broadcast authentication based on delayed key disclosure.serve as a basis for efficient secure networking protocols, e.g., for efficient broadcast authentication [31]. Secure Neighbor Discovery or Verification: A node must determine or verify its direct communication partners within a communication network [29]. Correct information about the network topology is essential for all routing protocols.What these examples have in common is that they all concern physical properties of the communication medium or the environment in which the nodes live. Furthermore, all of these protocols fall outside the scope of standard symbolic protocol models based on the Dolev-Yao intruder. 1 In this paper, we present a formal model for reasoning about the security guarantees of protocols like those listed above. Our model builds on standard symbolic approaches and accounts for physical properties like time, the location of network nodes, and properties of the communication medium. Honest agents and the intruder are modeled as network nodes. The intruder, in particular, is not modeled as a single entity but rather a distributed one and therefore corresponds to a set of nodes. The ability of the nodes to communicate and the speed of communication are determined by nodes' locations and by the propagation delays of the communication technologies they use. As a consequence, nodes (both honest and those controlled by the intruder) require time to share their knowledge and information cannot travel between nodes at speeds faster than the speed of light. The intruder and honest agents are therefore subject to physical restrictions. This results in a distributed intruder with communication abilities that are restricted, but more realistic than the classical Dolev-Yao intruder.Our model combines a message and a communication model. Whereas the message model allows us to capture cryptographic aspects of protocol messages (under the assumption of perfect cryptography), our communication model allows us to model relevant properties of the communication technology. Similar to Paulson's Inductive Approach [30], we have used Isabelle/HOL [28] to formalize our model and to prove security properties of the protocols 1. This is understandable: the Dolev-Yao model was developed fo...

Modeling and Verifying Ad Hoc Routing Protocols

“…Recently, several frameworks have been proposed to model wireless communication and/or routing protocols in a more accurate way (e.g. [15,17,10]). However, these models do not take into account several features that seem crucial to model routing protocols (e.g.…”

Investigation of Signal and Message Manipulations on the Wireless Channel

“…In the context of wireless systems, message-based attacker models have been adopted in a number of works, e. g., in [11,15,16,22,24,25]. In these works, the attacker is usually assumed to be able to eavesdrop, insert, modify, replay, delay, or delete any signal being transmitted on the wireless channel.…”

“…On the other hand, the strongest attacker models are often not motivated by practical considerations. For example, Dolev-Yao based models will allow the attacker to transfer information to remote locations instantaneously while this is not realistic [22]. Although designing a system with an overestimation of the attacker capabilities does not harm the security of the system, it may complicate the proposed solutions and create unnecessary overhead on the communication or make the hardware setup more costly.…”

A Formal Approach to Distance-Bounding RFID Protocols

“…Also, [31] shows a formal approach, but against honest provers only and without specifying security goals. Finally, the formal methods approach in [35] thoroughly models distance bounding with formal methods, but treats wireless networks in general, assuming that provers and verifiers have equal capacities (unlike RFID systems, where tags are computationally weaker). Additionally, some physical properties of RF communication, such as the unreliability of tags' backscattering and colliding signals, are unaccounted for.…”