SATMC: A SAT-Based Model Checker for Security-Critical Systems

Abstract

Abstract. We present SATMC 3.0, a SAT-based bounded model checker for security-critical systems that stems from a successful combination of encoding techniques originally developed for planning with techniques developed for the analysis of reactive systems. SATMC has been successfully applied in a variety of application domains (security protocols, securitysensitive business processes, and cryptographic APIs) and for different purposes (design-time security analysis and security testing). SATMC strikes a balance between general purpose model checkers and security protocol analyzers as witnessed by a number of important success stories including the discovery of a serious man-in-the-middle attack on the SAML-based Single Sign-On (SSO) for Google Apps, an authentication flaw in the SAML 2.0 Web Browser SSO Profile, and a number of attacks on PKCS#11 Security Tokens. SATMC is integrated and used as back-end in a number of research prototypes (e.g., the AVISPA Tool, Tookan, the SPaCIoS Tool) and industrial-strength tools (e.g., the Security Validator plugin for SAP NetWeaver BPM).

SAT-Equiv: An Efficient Tool for Equivalence Properties

“…Instead of designing a crafted algorithm for equivalence, we use more general verification techniques, namely Graph planning [14], [15] and SATsolving. The idea of using Graph planning and SAT-solvers for analyzing protocols has already been explored in [16], yielding the tool SATMC [17] for trace properties. Moving from trace to equivalence properties is far from being straightforward as exemplified by the research effort on equivalence these past 10 years (see e.g.…”

“…In [16], [17], the authors simply assume protocols to be given with a (finite) format for the messages. Here, we do not bound a priori the format of the messages.…”

Security Threat Identification and Testing

“…SATMC carries out an iterative deepening strategy on k. Initially k is set to 0, and then it is incremented till either an attack is found or an upper bound is reached. More details on SATMC can be found in [9]. When developing the STIATE back-end we also added two important features to SATMC: (i) a multi-attack module to identify multiple abstract attack traces (if any) from a single formal specification; and (ii) a multi-thread environment allowing the execution of SATMC over multiple ASLan++ models in parallel using multiple and dependent threads.…”

“…Once obtained the proper input files, the SAT-based bounded model checker SATMC [9] is used to check whether the protocols meet the expected security goals. Given a formal specification (in ASLan) of a protocol and a security goal, SATMC reduces the problem of determining whether the protocol violates the security goal in k > 0 steps to the problem of checking the satisfiability of a propositional formula (the SAT problem).…”

“…• (threat identification) the formal analysis of the generated formal specifications by using SATMC, a SAT-based bounded Model Checker that has been successfully used to discover serious flaws in security protocols and services [7], [9];…”