External Consistency and the Verification of Security Protocols

Abstract

The notion of external consistency—that system state correctly reflects the real world—provides a basis for a denotational definition of integrity. We regard segregation of duties, well formed transactions, auditing, replication, MACs, and so forth, as simply implementation techniques: they define how to achieve this notion of integrity in an operational sense. Therefore, we argue that when a designer claims that a system is fault-tolerant, or that a protocol properly authenticates, or that a system is secure against fraud, then what the designer is actually claiming is that it is externally consistent. An advantage of taking this view is that it allows us to give a meaning to the ‘security’ of a system that uses a combination of these implementation techniques.